lumma | hxxps://bonzi[.]link

Analysis

max time kernel
1000s
max time network
1610s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
31/03/2023, 20:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://bonzi.link

Score

10^/10

lumma discovery evasion spyware stealer trojan

Malware Config

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Downloads MZ/PE file

Checks computer location settings 2 TTPs 12 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	RobloxPlayerLauncher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	RobloxPlayerBeta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	RobloxPlayerBeta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	RobloxPlayerLauncher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	RobloxPlayerBeta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	RobloxPlayerLauncher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	RobloxPlayerBeta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	RobloxPlayerBeta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	RobloxPlayerLauncher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	krnl_bootstrapper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	RobloxPlayerLauncher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	RobloxPlayerLauncher.exe

Executes dropped EXE 22 IoCs

pid	Process
4868	krnl_bootstrapper.exe
5732	7za.exe
5136	7za.exe
4648	krnlss.exe
5596	RobloxPlayerLauncher.exe
3432	RobloxPlayerLauncher.exe
3292	RobloxPlayerLauncher.exe
4212	RobloxPlayerLauncher.exe
5896	RobloxPlayerBeta.exe
3776	krnlss.exe
5208	RobloxPlayerLauncher.exe
8988	RobloxPlayerLauncher.exe
1140	RobloxPlayerBeta.exe
3512	RobloxPlayerLauncher.exe
2756	RobloxPlayerLauncher.exe
8296	RobloxPlayerBeta.exe
3440	RobloxPlayerLauncher.exe
8904	RobloxPlayerLauncher.exe
6160	RobloxPlayerBeta.exe
7308	RobloxPlayerLauncher.exe
4456	RobloxPlayerLauncher.exe
7432	RobloxPlayerBeta.exe

Loads dropped DLL 64 IoCs

pid	Process
4648	krnlss.exe
4648	krnlss.exe
4648	krnlss.exe
4648	krnlss.exe
4648	krnlss.exe
4648	krnlss.exe
4648	krnlss.exe
4648	krnlss.exe
4648	krnlss.exe
4648	krnlss.exe
4648	krnlss.exe
4648	krnlss.exe
4648	krnlss.exe
4648	krnlss.exe
4648	krnlss.exe
4648	krnlss.exe
4648	krnlss.exe
4648	krnlss.exe
4648	krnlss.exe
4648	krnlss.exe
4648	krnlss.exe
4648	krnlss.exe
4648	krnlss.exe
4648	krnlss.exe
4648	krnlss.exe
3776	krnlss.exe
3776	krnlss.exe
3776	krnlss.exe
3776	krnlss.exe
3776	krnlss.exe
3776	krnlss.exe
3776	krnlss.exe
3776	krnlss.exe
3776	krnlss.exe
3776	krnlss.exe
3776	krnlss.exe
3776	krnlss.exe
3776	krnlss.exe
3776	krnlss.exe
3776	krnlss.exe
3776	krnlss.exe
3776	krnlss.exe
3776	krnlss.exe
3776	krnlss.exe
3776	krnlss.exe
3776	krnlss.exe
3776	krnlss.exe
3776	krnlss.exe
3776	krnlss.exe
3776	krnlss.exe
3776	krnlss.exe
3776	krnlss.exe
3776	krnlss.exe
1140	RobloxPlayerBeta.exe
3776	krnlss.exe
3776	krnlss.exe
3776	krnlss.exe
8296	RobloxPlayerBeta.exe
3776	krnlss.exe
3776	krnlss.exe
3776	krnlss.exe
6160	RobloxPlayerBeta.exe
3776	krnlss.exe
3776	krnlss.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerLauncher.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerLauncher.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerLauncher.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerLauncher.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerLauncher.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerLauncher.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\Squads\Lumberyak.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\TenFootUiGlobalNav\Dev\JestGlobals.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Packages\_Index\ExperienceChat-201ca530-56b79d20\ExperienceChat\displaySystemMessage.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\Analytics\Analytics\getPlatformTarget.impl.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\RobloxAppEnums\RobloxAppEnums\DeviceOrientationMode.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Packages\_Index\NetworkingUserInfo\NetworkingUserInfo\PREMIUM_FEATURES_URL.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Packages\_Index\RoactRodux\RoactRodux\StoreProvider.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Packages\_Index\RoduxFriends-aa874f8b-86a611f7\RoduxFriends\Enums\RecommendationContextType.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\content\textures\ui\PurchasePrompt\[email protected]	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\textures\ui\LuaChat\icons\ic-checkbox-on [email protected]	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Packages\_Index\LuauPolyfill-2fca3173-0.4.2\LuauPolyfill\Array\map.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Packages\_Index\llama\llama\Dictionary\init.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Packages\_Index\ReactReconciler-9c8468d8-8a7220fd\ReactReconciler\ReactStrictModeWarnings.new.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Packages\_Index\RoduxNetworking\RoduxNetworking\RoduxNetworking.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\content\textures\HingeCursor.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Packages\_Index\Expect-edcba0e9-2.4.1\Expect\init.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Packages\_Index\IAPExperience\IAPExperience\Stories\Public\RobuxUpsellFlowInGame.story.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Packages\_Index\DataLoader\lock.toml	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Packages\_Index\ExperienceChat-201ca530-56b79d20\ExperienceChat\isWhiteSpaceOnly.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\ContactImporter\ContactImporter\Common\IXPVariants.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\content\textures\RoactStudioWidgets\button_radiobutton_chosen.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\content\textures\ui\Settings\Slider\[email protected]	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Packages\_Index\ApolloClient\ApolloClient\cache\inmemory\helpers.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Packages\_Index\IAPExperience\IAPExperience\PurchaseFlow\PremiumUpsell\PremiumUpsellFlow.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Packages\_Index\ReactReconciler-9c8468d8-8a7220fd\ReactReconciler\ReactProfilerTimer.new.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\GraphqlHttpArtifacts\GraphqlHttpArtifacts\virtual-event-update-rsvp-success\apis.roblox.com\post.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\SocialTabTestSuite\SocialTabTestSuite\init.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\content\textures\loading\robloxlogo.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Packages\_Index\ReactProxy\ReactProxy\Shared\flowtypes.roblox.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\SetAlias\Dev\RobloxAppUIBloxConfig.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\content\textures\ui\TopBar\[email protected]	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\content\textures\ui\VoiceChat\SpeakerLight\[email protected]	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Packages\_Index\DomTestingLibrary\DomTestingLibrary\types\get-node-text.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Packages\_Index\ExperienceChat-2bd849d2-78d25f7e\ExperienceChat\createDispatchBindableEvent.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Packages\_Index\ReactRobloxProxy\ReactRobloxProxy\init.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\content\textures\DeveloperFramework\AudioPlayer\audioPlay_BG.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\content\textures\RoactStudioWidgets\toggle_disable_light.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\content\textures\ui\Settings\Players\FriendIcon.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\SharedFlags\SharedFlags\getFFlagSocialAddMessageModal.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\UserSearch\UserSearch\Stories\UserSearchTile.story.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\MessageToast\Dev\RhodiumHelpers.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\VirtualizedList\VirtualizedList\init.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Packages\_Index\NetworkingPresence-1b011daa-31f6545b\NetworkingPresence\init.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\ApolloClientTesting\ApolloClientTesting\init.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\ContactImporter\ContactImporter\ContactsList\Components\ContactsEmptyList\ContactsEmptyList.story.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\FriendsLanding\FriendsLanding\Components\AddFriends\AddFriendsContainer\init.test.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\FriendsLanding\FriendsLanding\Flags\getFFlagVerifiedBadgeInFriendsLanding.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\Http\UrlBuilder.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\PlayabilityRodux\PlayabilityRodux\Enums\PlayabilityStatusEnum.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\Squads\Squads\SquadLobby\Components\SquadLobbyPeekViewTopBar\SquadLobbyPeekViewTopBar.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\textures\ui\LuaChat\graphic\gr-indicator-ingame-6x6.png	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Packages\_Index\NetworkingGames-40b180a4-1.2.0\NetworkingGames\init.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\FriendsCarousel\FriendsCarousel\Components\LoadingTile\LoadingTile.test.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\UserLib\UserLib\Models\User.spec.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Packages\_Index\DomTestingLibrary\PrettyFormat.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\SocialTab\Http.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Packages\_Index\roblox_rodux\rodux\thunkMiddleware.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\VirtualEvents\RoactRodux.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Packages\_Index\GraphQL\GraphQL\validation\__tests__\UniqueTypeNamesRule.spec.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Packages\_Index\ReactDevtoolsShared-a406e214-4230f473\ReactDevtoolsShared\backend\types.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Packages\_Index\RobloxShared-edcba0e9-2.4.1\RobloxShared\RobloxInstance.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Packages\_Index\llama\llama\List\findWhereLast.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Packages\_Index\SocialLibraries\SocialLibraries\Components\init.lua	RobloxPlayerLauncher.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\ExtraContent\LuaPackages\Workspace\Packages\_Workspace\FriendsCarousel\FriendsCarousel\Flags\getFFlagFriendsCarouselAddUniverseIdToEvents.lua	RobloxPlayerLauncher.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe

Checks processor information in registry 2 TTPs 39 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Modifies Internet Explorer settings 1 TTPs 51 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	RobloxPlayerBeta.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	RobloxPlayerBeta.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\RobloxPlayerBeta.exe = "11000"	RobloxPlayerBeta.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\bonzi.link\Total = "26"	IEXPLORE.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerLauncher.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerLauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\DOMStorage\bonzi.link	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\bonzi.link\ = "26"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\RobloxPlayerBeta.exe = "11000"	RobloxPlayerBeta.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerLauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerLauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{BC2353AC-D011-11ED-9F77-4E89871AD1F5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\bonzi.link	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\bonzi.link\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	RobloxPlayerBeta.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerLauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\RobloxPlayerBeta.exe = "11000"	RobloxPlayerBeta.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerLauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\RobloxPlayerBeta.exe = "11000"	RobloxPlayerBeta.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\RobloxPlayerBeta.exe = "11000"	RobloxPlayerBeta.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "26"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerLauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	RobloxPlayerBeta.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerLauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	RobloxPlayerBeta.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "3"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "4"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "5"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Direct3D	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "1"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Direct3D	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "2"	svchost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1675742406-747946869-1029867430-1000\{FA0E4130-02F5-450F-8FDF-30EF0C5E245D}	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1675742406-747946869-1029867430-1000\{6251EE16-AD60-4548-B08A-16EB32217C12}	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\roblox-player\shell\open	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1675742406-747946869-1029867430-1000\{C0CBC89F-F0DD-4926-8EBC-EEEFE72C89C2}	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\roblox-player\DefaultIcon	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\roblox-player\DefaultIcon	RobloxPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\roblox-player\shell\open\command	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\roblox-player\URL Protocol	RobloxPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\roblox-player\shell\open	RobloxPlayerLauncher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 0c0001008421de39050000000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\roblox-player	RobloxPlayerLauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\ShowCmd = "1"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\roblox-player\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-be30b823d3fc46a0\\RobloxPlayerLauncher.exe"	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-be30b823d3fc46a0\\RobloxPlayerLauncher.exe\" %1"	RobloxPlayerLauncher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioLauncherBeta.exe"	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open	RobloxPlayerLauncher.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\roblox-player\shell\open	RobloxPlayerLauncher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerLauncher.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\roblox-player\shell\open\command	RobloxPlayerLauncher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerLauncher.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\roblox-player\shell	RobloxPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\roblox-player\shell\open	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1675742406-747946869-1029867430-1000\{B82AF2C4-0729-47A4-BB31-7B00188A328E}	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\FirewallControlPanel.dll,-12122#immutable1 = "Windows Defender Firewall"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{65F125E5-7BE1-4810-BA9D-D271C8432CE3}"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\roblox-player\shell	RobloxPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\roblox-player	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio	RobloxPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\roblox-player	RobloxPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000010000001800000030f125b7ef471a10a5f102608c9eebac0a000000a0000000	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1675742406-747946869-1029867430-1000\{3328FE3A-7804-48F2-9739-9C62705A73CA}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1675742406-747946869-1029867430-1000\{4CD19AD8-B08E-4F62-B3FA-0AAD7FE7C434}	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\roblox-player	RobloxPlayerLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\roblox-player\URL Protocol	RobloxPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\roblox-player\shell	RobloxPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "18874369"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\WFlags = "0"	explorer.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\roblox-player	RobloxPlayerLauncher.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1675742406-747946869-1029867430-1000\{751DF630-15E9-48FE-871C-FB3A7F580B81}	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	RobloxPlayerLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell	explorer.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\roblox-player\DefaultIcon	RobloxPlayerLauncher.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\roblox-player\shell	RobloxPlayerLauncher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe

NTFS ADS 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\krnl_bootstrapper.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe:Zone.Identifier	firefox.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerLauncher.exe\:Zone.Identifier:$DATA	RobloxPlayerLauncher.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5712	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4868	krnl_bootstrapper.exe
4868	krnl_bootstrapper.exe
4868	krnl_bootstrapper.exe
4868	krnl_bootstrapper.exe
4648	krnlss.exe
4648	krnlss.exe
5596	RobloxPlayerLauncher.exe
5596	RobloxPlayerLauncher.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
5596	RobloxPlayerLauncher.exe
5596	RobloxPlayerLauncher.exe
5596	RobloxPlayerLauncher.exe
5596	RobloxPlayerLauncher.exe
5596	RobloxPlayerLauncher.exe
5596	RobloxPlayerLauncher.exe
5596	RobloxPlayerLauncher.exe
5596	RobloxPlayerLauncher.exe
5596	RobloxPlayerLauncher.exe
5596	RobloxPlayerLauncher.exe
5596	RobloxPlayerLauncher.exe
5596	RobloxPlayerLauncher.exe
5596	RobloxPlayerLauncher.exe
5596	RobloxPlayerLauncher.exe
5596	RobloxPlayerLauncher.exe
5596	RobloxPlayerLauncher.exe
5596	RobloxPlayerLauncher.exe
5596	RobloxPlayerLauncher.exe

Suspicious behavior: GetForegroundWindowSpam 13 IoCs

pid	Process
3196	taskmgr.exe
5896	RobloxPlayerBeta.exe
4648	krnlss.exe
3452	OpenWith.exe
1140	RobloxPlayerBeta.exe
8296	RobloxPlayerBeta.exe
6160	RobloxPlayerBeta.exe
4044	OpenWith.exe
3412	taskmgr.exe
7272	OpenWith.exe
7432	RobloxPlayerBeta.exe
8068	OpenWith.exe
7956	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 55 IoCs

description	pid	Process
Token: SeDebugPrivilege	3624	firefox.exe
Token: SeDebugPrivilege	3624	firefox.exe
Token: SeDebugPrivilege	4868	krnl_bootstrapper.exe
Token: SeRestorePrivilege	5732	7za.exe
Token: 35	5732	7za.exe
Token: SeSecurityPrivilege	5732	7za.exe
Token: SeSecurityPrivilege	5732	7za.exe
Token: SeShutdownPrivilege	5712	explorer.exe
Token: SeCreatePagefilePrivilege	5712	explorer.exe
Token: SeRestorePrivilege	5136	7za.exe
Token: 35	5136	7za.exe
Token: SeSecurityPrivilege	5136	7za.exe
Token: SeSecurityPrivilege	5136	7za.exe
Token: SeDebugPrivilege	4648	krnlss.exe
Token: SeDebugPrivilege	3624	firefox.exe
Token: SeDebugPrivilege	3624	firefox.exe
Token: SeDebugPrivilege	3624	firefox.exe
Token: 33	796	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	796	AUDIODG.EXE
Token: SeDebugPrivilege	5596	RobloxPlayerLauncher.exe
Token: SeDebugPrivilege	5596	RobloxPlayerLauncher.exe
Token: SeDebugPrivilege	5596	RobloxPlayerLauncher.exe
Token: SeDebugPrivilege	5596	RobloxPlayerLauncher.exe
Token: SeDebugPrivilege	5596	RobloxPlayerLauncher.exe
Token: SeDebugPrivilege	3196	taskmgr.exe
Token: SeSystemProfilePrivilege	3196	taskmgr.exe
Token: SeCreateGlobalPrivilege	3196	taskmgr.exe
Token: SeDebugPrivilege	3624	firefox.exe
Token: 33	3196	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3196	taskmgr.exe
Token: SeDebugPrivilege	5596	RobloxPlayerLauncher.exe
Token: SeDebugPrivilege	5596	RobloxPlayerLauncher.exe
Token: SeDebugPrivilege	5596	RobloxPlayerLauncher.exe
Token: SeDebugPrivilege	5596	RobloxPlayerLauncher.exe
Token: SeDebugPrivilege	5596	RobloxPlayerLauncher.exe
Token: SeDebugPrivilege	5596	RobloxPlayerLauncher.exe
Token: SeDebugPrivilege	5596	RobloxPlayerLauncher.exe
Token: SeDebugPrivilege	5596	RobloxPlayerLauncher.exe
Token: SeDebugPrivilege	3156	firefox.exe
Token: SeDebugPrivilege	3156	firefox.exe
Token: SeDebugPrivilege	4648	krnlss.exe
Token: SeLoadDriverPrivilege	4648	krnlss.exe
Token: SeDebugPrivilege	3156	firefox.exe
Token: SeDebugPrivilege	3156	firefox.exe
Token: SeDebugPrivilege	3156	firefox.exe
Token: SeDebugPrivilege	3156	firefox.exe
Token: SeDebugPrivilege	3776	krnlss.exe
Token: SeDebugPrivilege	3156	firefox.exe
Token: SeDebugPrivilege	3776	krnlss.exe
Token: SeLoadDriverPrivilege	3776	krnlss.exe
Token: SeDebugPrivilege	3156	firefox.exe
Token: SeDebugPrivilege	3412	taskmgr.exe
Token: SeSystemProfilePrivilege	3412	taskmgr.exe
Token: SeCreateGlobalPrivilege	3412	taskmgr.exe
Token: SeDebugPrivilege	3156	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
748	iexplore.exe
3624	firefox.exe
3624	firefox.exe
3624	firefox.exe
3624	firefox.exe
5712	explorer.exe
5712	explorer.exe
5712	explorer.exe
4648	krnlss.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3156	firefox.exe
3156	firefox.exe
3156	firefox.exe
3156	firefox.exe
3156	firefox.exe
3156	firefox.exe
3156	firefox.exe
3412	taskmgr.exe
3412	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3624	firefox.exe
3624	firefox.exe
3624	firefox.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3156	firefox.exe
3156	firefox.exe
3156	firefox.exe
3156	firefox.exe
3156	firefox.exe
3156	firefox.exe
3412	taskmgr.exe
3412	taskmgr.exe
3412	taskmgr.exe
3412	taskmgr.exe
3412	taskmgr.exe
3412	taskmgr.exe
3412	taskmgr.exe
3412	taskmgr.exe
3412	taskmgr.exe

Suspicious use of SetWindowsHookEx 42 IoCs

pid	Process
748	iexplore.exe
748	iexplore.exe
4264	IEXPLORE.EXE
4264	IEXPLORE.EXE
3624	firefox.exe
3624	firefox.exe
3624	firefox.exe
3624	firefox.exe
3624	firefox.exe
3624	firefox.exe
3624	firefox.exe
3624	firefox.exe
3624	firefox.exe
3624	firefox.exe
3624	firefox.exe
3624	firefox.exe
3624	firefox.exe
3156	firefox.exe
5896	RobloxPlayerBeta.exe
5896	RobloxPlayerBeta.exe
5164	OpenWith.exe
3452	OpenWith.exe
1140	RobloxPlayerBeta.exe
1140	RobloxPlayerBeta.exe
5796	OpenWith.exe
8296	RobloxPlayerBeta.exe
8296	RobloxPlayerBeta.exe
7228	OpenWith.exe
3756	OpenWith.exe
8296	RobloxPlayerBeta.exe
1208	OpenWith.exe
7216	OpenWith.exe
6160	RobloxPlayerBeta.exe
6160	RobloxPlayerBeta.exe
4044	OpenWith.exe
6160	RobloxPlayerBeta.exe
7272	OpenWith.exe
8068	OpenWith.exe
7432	RobloxPlayerBeta.exe
7432	RobloxPlayerBeta.exe
7432	RobloxPlayerBeta.exe
7956	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 748 wrote to memory of 4264	748	iexplore.exe	84
PID 748 wrote to memory of 4264	748	iexplore.exe	84
PID 748 wrote to memory of 4264	748	iexplore.exe	84
PID 1420 wrote to memory of 3624	1420	firefox.exe	88
PID 1420 wrote to memory of 3624	1420	firefox.exe	88
PID 1420 wrote to memory of 3624	1420	firefox.exe	88
PID 1420 wrote to memory of 3624	1420	firefox.exe	88
PID 1420 wrote to memory of 3624	1420	firefox.exe	88
PID 1420 wrote to memory of 3624	1420	firefox.exe	88
PID 1420 wrote to memory of 3624	1420	firefox.exe	88
PID 1420 wrote to memory of 3624	1420	firefox.exe	88
PID 1420 wrote to memory of 3624	1420	firefox.exe	88
PID 1420 wrote to memory of 3624	1420	firefox.exe	88
PID 1420 wrote to memory of 3624	1420	firefox.exe	88
PID 3624 wrote to memory of 4792	3624	firefox.exe	89
PID 3624 wrote to memory of 4792	3624	firefox.exe	89
PID 3624 wrote to memory of 4376	3624	firefox.exe	90
PID 3624 wrote to memory of 4376	3624	firefox.exe	90
PID 3624 wrote to memory of 4376	3624	firefox.exe	90
PID 3624 wrote to memory of 4376	3624	firefox.exe	90
PID 3624 wrote to memory of 4376	3624	firefox.exe	90
PID 3624 wrote to memory of 4376	3624	firefox.exe	90
PID 3624 wrote to memory of 4376	3624	firefox.exe	90
PID 3624 wrote to memory of 4376	3624	firefox.exe	90
PID 3624 wrote to memory of 4376	3624	firefox.exe	90
PID 3624 wrote to memory of 4376	3624	firefox.exe	90
PID 3624 wrote to memory of 4376	3624	firefox.exe	90
PID 3624 wrote to memory of 4376	3624	firefox.exe	90
PID 3624 wrote to memory of 4376	3624	firefox.exe	90
PID 3624 wrote to memory of 4376	3624	firefox.exe	90
PID 3624 wrote to memory of 4376	3624	firefox.exe	90
PID 3624 wrote to memory of 4376	3624	firefox.exe	90
PID 3624 wrote to memory of 4376	3624	firefox.exe	90
PID 3624 wrote to memory of 4376	3624	firefox.exe	90
PID 3624 wrote to memory of 4376	3624	firefox.exe	90
PID 3624 wrote to memory of 4376	3624	firefox.exe	90
PID 3624 wrote to memory of 4376	3624	firefox.exe	90
PID 3624 wrote to memory of 4376	3624	firefox.exe	90
PID 3624 wrote to memory of 4376	3624	firefox.exe	90
PID 3624 wrote to memory of 4376	3624	firefox.exe	90
PID 3624 wrote to memory of 4376	3624	firefox.exe	90
PID 3624 wrote to memory of 4376	3624	firefox.exe	90
PID 3624 wrote to memory of 4376	3624	firefox.exe	90
PID 3624 wrote to memory of 4376	3624	firefox.exe	90
PID 3624 wrote to memory of 4376	3624	firefox.exe	90
PID 3624 wrote to memory of 4376	3624	firefox.exe	90
PID 3624 wrote to memory of 4376	3624	firefox.exe	90
PID 3624 wrote to memory of 4376	3624	firefox.exe	90
PID 3624 wrote to memory of 4376	3624	firefox.exe	90
PID 3624 wrote to memory of 4376	3624	firefox.exe	90
PID 3624 wrote to memory of 4376	3624	firefox.exe	90
PID 3624 wrote to memory of 4376	3624	firefox.exe	90
PID 3624 wrote to memory of 4376	3624	firefox.exe	90
PID 3624 wrote to memory of 4376	3624	firefox.exe	90
PID 3624 wrote to memory of 4376	3624	firefox.exe	90
PID 3624 wrote to memory of 4376	3624	firefox.exe	90
PID 3624 wrote to memory of 4376	3624	firefox.exe	90
PID 3624 wrote to memory of 4376	3624	firefox.exe	90
PID 3624 wrote to memory of 4376	3624	firefox.exe	90
PID 3624 wrote to memory of 4376	3624	firefox.exe	90
PID 3624 wrote to memory of 4376	3624	firefox.exe	90
PID 3624 wrote to memory of 4376	3624	firefox.exe	90
PID 3624 wrote to memory of 4376	3624	firefox.exe	90
PID 3624 wrote to memory of 4376	3624	firefox.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://bonzi.link
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:748
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:748 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:4264

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3624
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3624.0.661947718\1337982654" -parentBuildID 20221007134813 -prefsHandle 1824 -prefMapHandle 1816 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4dc90094-6265-4bca-a8a3-2e8937705997} 3624 "\\.\pipe\gecko-crash-server-pipe.3624" 1916 2bda51e7558 gpu
    3⤵
    PID:4792
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3624.1.1043632918\355909331" -parentBuildID 20221007134813 -prefsHandle 2304 -prefMapHandle 2300 -prefsLen 20926 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {abae86ce-de24-4fa9-a5e9-f9357d389c10} 3624 "\\.\pipe\gecko-crash-server-pipe.3624" 2316 2bd9826fb58 socket
    3⤵
    - Checks processor information in registry
    PID:4376
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3624.2.1317527763\1429990599" -childID 1 -isForBrowser -prefsHandle 2964 -prefMapHandle 2884 -prefsLen 21074 -prefMapSize 232675 -jsInitHandle 1440 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aafcfb85-d8ae-48dc-8904-ab1b9a783253} 3624 "\\.\pipe\gecko-crash-server-pipe.3624" 2888 2bda8f37758 tab
    3⤵
    PID:3840
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3624.3.31212727\510920450" -childID 2 -isForBrowser -prefsHandle 1396 -prefMapHandle 2464 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1440 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d3a6e56e-f1b4-4707-9345-f4b402fa38c3} 3624 "\\.\pipe\gecko-crash-server-pipe.3624" 1236 2bd98262558 tab
    3⤵
    PID:1904
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3624.4.2139355374\660696618" -childID 3 -isForBrowser -prefsHandle 4044 -prefMapHandle 4040 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1440 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ca5e20e0-28e7-431b-8006-27e412b60798} 3624 "\\.\pipe\gecko-crash-server-pipe.3624" 4048 2bdaa08e558 tab
    3⤵
    PID:2168
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3624.5.625064811\522583975" -childID 4 -isForBrowser -prefsHandle 4812 -prefMapHandle 4824 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1440 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9551d611-bdd8-4493-b35d-134c6a4b694f} 3624 "\\.\pipe\gecko-crash-server-pipe.3624" 4652 2bda9525f58 tab
    3⤵
    PID:3768
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3624.6.1201118813\1634745064" -childID 5 -isForBrowser -prefsHandle 4864 -prefMapHandle 4176 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1440 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {03b4c0f7-acba-4683-9ceb-be7e04e886c8} 3624 "\\.\pipe\gecko-crash-server-pipe.3624" 4876 2bdab297f58 tab
    3⤵
    PID:1696
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3624.7.1330553818\1908310820" -childID 6 -isForBrowser -prefsHandle 5260 -prefMapHandle 5264 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1440 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {24a39f07-c963-4e0a-bd01-ba20d5cff350} 3624 "\\.\pipe\gecko-crash-server-pipe.3624" 5248 2bdab549758 tab
    3⤵
    PID:3964
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3624.8.1303246907\2114311122" -childID 7 -isForBrowser -prefsHandle 5752 -prefMapHandle 5740 -prefsLen 26913 -prefMapSize 232675 -jsInitHandle 1440 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2ee051f5-9d10-4c53-9e03-184a4afa3e0b} 3624 "\\.\pipe\gecko-crash-server-pipe.3624" 5724 2bdad9ad958 tab
    3⤵
    PID:4640
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3624.9.1321383928\195973302" -childID 8 -isForBrowser -prefsHandle 4772 -prefMapHandle 5168 -prefsLen 26930 -prefMapSize 232675 -jsInitHandle 1440 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {85467aba-c520-4ccc-b7f3-77ffb1f547b3} 3624 "\\.\pipe\gecko-crash-server-pipe.3624" 6068 2bda75e7c58 tab
    3⤵
    PID:1808
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3624.10.1501064305\1188783256" -childID 9 -isForBrowser -prefsHandle 4992 -prefMapHandle 5128 -prefsLen 26930 -prefMapSize 232675 -jsInitHandle 1440 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {78ced89b-39a2-404f-9b7a-6e92892346bb} 3624 "\\.\pipe\gecko-crash-server-pipe.3624" 5024 2bdae4e6458 tab
    3⤵
    PID:5112
- - C:\Users\Admin\Downloads\krnl_bootstrapper.exe
    "C:\Users\Admin\Downloads\krnl_bootstrapper.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4868
  - - C:\Users\Admin\Downloads\krnl\7za.exe
      "C:\Users\Admin\Downloads\krnl\7za.exe" x "C:\Users\Admin\Downloads\krnl\bin\Monaco.zip" -o"C:\Users\Admin\Downloads\krnl\bin" -aoa -bsp1
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:5732
  - - C:\Users\Admin\Downloads\krnl\7za.exe
      "C:\Users\Admin\Downloads\krnl\7za.exe" x "C:\Users\Admin\Downloads\krnl\bin\src.7z" -o"C:\Users\Admin\Downloads\krnl\bin" -aoa -bsp1
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:5136
  - - C:\Users\Admin\Downloads\krnl\krnlss.exe
      "C:\Users\Admin\Downloads\krnl\krnlss.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      PID:4648
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3624.11.2116320096\214858409" -childID 10 -isForBrowser -prefsHandle 5352 -prefMapHandle 5420 -prefsLen 27371 -prefMapSize 232675 -jsInitHandle 1440 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e1313892-7701-43f9-aea0-b5c32ab55921} 3624 "\\.\pipe\gecko-crash-server-pipe.3624" 6092 2bdae6ec158 tab
    3⤵
    PID:4852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3624.12.1856753495\1978484153" -childID 11 -isForBrowser -prefsHandle 10088 -prefMapHandle 9936 -prefsLen 27371 -prefMapSize 232675 -jsInitHandle 1440 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f89f0fc8-5ad0-44ba-a9e3-7380fc4b0e33} 3624 "\\.\pipe\gecko-crash-server-pipe.3624" 6772 2bdac660e58 tab
    3⤵
    PID:5016
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3624.13.207599424\47108953" -childID 12 -isForBrowser -prefsHandle 9888 -prefMapHandle 9892 -prefsLen 27380 -prefMapSize 232675 -jsInitHandle 1440 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {87466187-e8a4-4b9f-a8a2-982cfceffb23} 3624 "\\.\pipe\gecko-crash-server-pipe.3624" 9880 2bdb2c29c58 tab
    3⤵
    PID:3928
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3624.14.687843619\1362405918" -parentBuildID 20221007134813 -prefsHandle 10756 -prefMapHandle 10752 -prefsLen 27380 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4f8655f8-6e5f-4cac-800d-3e00d7c62096} 3624 "\\.\pipe\gecko-crash-server-pipe.3624" 10744 2bdb2d59c58 rdd
    3⤵
    PID:4888
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3624.15.476985703\481628803" -childID 13 -isForBrowser -prefsHandle 10260 -prefMapHandle 10264 -prefsLen 27380 -prefMapSize 232675 -jsInitHandle 1440 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {494a8746-5539-4f4b-9aad-237dbb1a19f6} 3624 "\\.\pipe\gecko-crash-server-pipe.3624" 10280 2bd98261c58 tab
    3⤵
    PID:2100
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3624.16.1966427493\893409068" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 4892 -prefMapHandle 4936 -prefsLen 27380 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b1657616-8dc6-4f25-9d07-2f94638efb23} 3624 "\\.\pipe\gecko-crash-server-pipe.3624" 4952 2bdb2171258 utility
    3⤵
    PID:5816
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3624.17.791351876\199778026" -childID 14 -isForBrowser -prefsHandle 9804 -prefMapHandle 9416 -prefsLen 27380 -prefMapSize 232675 -jsInitHandle 1440 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c7d21ddf-4adc-4000-83b6-f7941c4f8642} 3624 "\\.\pipe\gecko-crash-server-pipe.3624" 9400 2bdb2ddd758 tab
    3⤵
    PID:5516
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3624.18.550733200\1722583539" -childID 15 -isForBrowser -prefsHandle 10560 -prefMapHandle 10416 -prefsLen 27380 -prefMapSize 232675 -jsInitHandle 1440 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8153f5ba-e0a6-4c68-8a63-2a31704e6d76} 3624 "\\.\pipe\gecko-crash-server-pipe.3624" 5504 2bdb413ad58 tab
    3⤵
    PID:3616
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3624.20.1152855689\1703893608" -childID 17 -isForBrowser -prefsHandle 8904 -prefMapHandle 8900 -prefsLen 27380 -prefMapSize 232675 -jsInitHandle 1440 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aa4c0fe6-00b1-4bb1-a137-d4a1baaa4c22} 3624 "\\.\pipe\gecko-crash-server-pipe.3624" 8920 2bdb2170c58 tab
    3⤵
    PID:2036
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3624.19.263642058\836902583" -childID 16 -isForBrowser -prefsHandle 10516 -prefMapHandle 10716 -prefsLen 27380 -prefMapSize 232675 -jsInitHandle 1440 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c32a02e5-bfd1-462b-b76d-b72d26866bdd} 3624 "\\.\pipe\gecko-crash-server-pipe.3624" 3692 2bdb4c33358 tab
    3⤵
    PID:5848
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3624.22.711703843\1660639580" -childID 19 -isForBrowser -prefsHandle 10912 -prefMapHandle 10916 -prefsLen 27380 -prefMapSize 232675 -jsInitHandle 1440 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {40365029-6742-4a0d-90d4-621aff2fac3d} 3624 "\\.\pipe\gecko-crash-server-pipe.3624" 8460 2bdb4e35d58 tab
    3⤵
    PID:3652
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3624.21.517867416\103548247" -childID 18 -isForBrowser -prefsHandle 8736 -prefMapHandle 8732 -prefsLen 27380 -prefMapSize 232675 -jsInitHandle 1440 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3008238c-78ab-40b8-9e60-841486b60a9f} 3624 "\\.\pipe\gecko-crash-server-pipe.3624" 8752 2bdb4e34e58 tab
    3⤵
    PID:5484
- - C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe
    "C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Drops file in Program Files directory
    - Modifies Internet Explorer settings
    - Modifies registry class
    - NTFS ADS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5596
  - - C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe
      C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=b30562552e929b28b3892128001fd4fb6e2722a8 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x7e8,0x7ec,0x7f0,0x6f4,0x7f8,0xb2b480,0xb2b490,0xb2b4a0
      4⤵
      Executes dropped EXE
      PID:3432

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5568

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:5648

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5712

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:6136

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x478 0x494
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:796

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3196

C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerLauncher.exe
"C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerLauncher.exe" roblox-player:1+launchmode:play+gameinfo:6ZbbAY63RSawVJZmJq-b5yzNCu-_i0rRm8l4RQW8Xcy0Zt5_9TuAFMn74D12bpOyuHVSIkJHk3Cm93zFx8rkHQFyAA4Ud_1tZ9zJPWYfdNamKFGMBCLegDWVpXWr5Z0_IwrZ71CtH7u721-RND6T0msX98QCcwsJh5VSgoSSqwIcazEMx2r-wr2d2LNjtem2iM46TDZr5YEGZL5VW5NbHBWyIp1k7Yggdhyk-9sqpBE+launchtime:1680301279331+placelauncherurl:https%3A%2F%2Fassetgame.roblox.com%2Fgame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D167645108211%26placeId%3D621129760%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3Dd5074ccf-76e2-43f1-b450-6e9335c23147%26joinAttemptOrigin%3DPlayButton+browsertrackerid:167645108211+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp
1⤵
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
- Modifies registry class
PID:3292
- C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerLauncher.exe
  "C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerLauncher.exe" --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=b30562552e929b28b3892128001fd4fb6e2722a8 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x714,0x718,0x71c,0x68c,0x73c,0x9cb480,0x9cb490,0x9cb4a0
  2⤵
  - Executes dropped EXE
  PID:4212
- C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerBeta.exe" --app -t 6ZbbAY63RSawVJZmJq-b5yzNCu-_i0rRm8l4RQW8Xcy0Zt5_9TuAFMn74D12bpOyuHVSIkJHk3Cm93zFx8rkHQFyAA4Ud_1tZ9zJPWYfdNamKFGMBCLegDWVpXWr5Z0_IwrZ71CtH7u721-RND6T0msX98QCcwsJh5VSgoSSqwIcazEMx2r-wr2d2LNjtem2iM46TDZr5YEGZL5VW5NbHBWyIp1k7Yggdhyk-9sqpBE -j https://assetgame.roblox.com/game/PlaceLauncher.ashx?request=RequestGame&browserTrackerId=167645108211&placeId=621129760&isPlayTogetherGame=false&joinAttemptId=d5074ccf-76e2-43f1-b450-6e9335c23147&joinAttemptOrigin=PlayButton -b 167645108211 --launchtime=1680301279331 --rloc en_us --gloc en_us
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:5896

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:2080
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3156
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3156.0.509678027\593835951" -parentBuildID 20221007134813 -prefsHandle 1652 -prefMapHandle 1588 -prefsLen 20890 -prefMapSize 232711 -appDir "C:\Program Files\Mozilla Firefox\browser" - {913ad74a-fd37-47ce-bf5a-ec51530b4749} 3156 "\\.\pipe\gecko-crash-server-pipe.3156" 1752 2bdfe9e6a58 gpu
    3⤵
    PID:3868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3156.1.969876139\225053932" -parentBuildID 20221007134813 -prefsHandle 2152 -prefMapHandle 2148 -prefsLen 20890 -prefMapSize 232711 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6639a73d-5893-4131-b050-4742bd323ea7} 3156 "\\.\pipe\gecko-crash-server-pipe.3156" 2164 2bdfe539858 socket
    3⤵
    PID:6016
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3156.2.804100771\949777783" -childID 1 -isForBrowser -prefsHandle 2868 -prefMapHandle 3000 -prefsLen 21437 -prefMapSize 232711 -jsInitHandle 1060 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a5d41545-3d22-4ac6-abe9-882e71e2d7be} 3156 "\\.\pipe\gecko-crash-server-pipe.3156" 2964 2bd84d37958 tab
    3⤵
    PID:2024
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3156.3.1880486982\810550837" -childID 2 -isForBrowser -prefsHandle 3436 -prefMapHandle 1068 -prefsLen 26049 -prefMapSize 232711 -jsInitHandle 1060 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {28d29efb-3cc2-49ef-9aa7-e7dd3b0f2819} 3156 "\\.\pipe\gecko-crash-server-pipe.3156" 3460 2bd85cf7158 tab
    3⤵
    PID:4092
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3156.4.146508750\2135411882" -childID 3 -isForBrowser -prefsHandle 4796 -prefMapHandle 4756 -prefsLen 26969 -prefMapSize 232711 -jsInitHandle 1060 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {24471fd0-f163-4d6a-a269-1029f8eb8cfb} 3156 "\\.\pipe\gecko-crash-server-pipe.3156" 4804 2bd87a78858 tab
    3⤵
    PID:1956
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3156.5.1057557342\957503685" -childID 4 -isForBrowser -prefsHandle 4956 -prefMapHandle 5108 -prefsLen 26969 -prefMapSize 232711 -jsInitHandle 1060 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {69ff7fef-523a-4453-9fb5-e8d89eed3d79} 3156 "\\.\pipe\gecko-crash-server-pipe.3156" 4964 2bd88625258 tab
    3⤵
    PID:4456
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3156.6.1939102449\2137457857" -childID 5 -isForBrowser -prefsHandle 5148 -prefMapHandle 5360 -prefsLen 26969 -prefMapSize 232711 -jsInitHandle 1060 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b1f2dccb-cbdc-4176-8cbb-2456d435b5bb} 3156 "\\.\pipe\gecko-crash-server-pipe.3156" 5352 2bd88627658 tab
    3⤵
    PID:3216
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3156.7.241823925\942025386" -childID 6 -isForBrowser -prefsHandle 5580 -prefMapHandle 5512 -prefsLen 26969 -prefMapSize 232711 -jsInitHandle 1060 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8d5b1cb3-9e72-4d59-96b8-619fda964317} 3156 "\\.\pipe\gecko-crash-server-pipe.3156" 5496 2bd8882b458 tab
    3⤵
    PID:1960
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3156.8.1205823527\804707253" -childID 7 -isForBrowser -prefsHandle 6220 -prefMapHandle 3932 -prefsLen 27600 -prefMapSize 232711 -jsInitHandle 1060 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {06bc32cf-75c0-49ef-950f-02ea9b048dc3} 3156 "\\.\pipe\gecko-crash-server-pipe.3156" 6240 2bd8858a858 tab
    3⤵
    PID:6572
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3156.10.1162708598\1686210535" -childID 8 -isForBrowser -prefsHandle 10040 -prefMapHandle 10036 -prefsLen 27600 -prefMapSize 232711 -jsInitHandle 1060 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aa38973a-7758-4582-9e64-7418b308f5e6} 3156 "\\.\pipe\gecko-crash-server-pipe.3156" 10064 2bd8962b758 tab
    3⤵
    PID:7020
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3156.9.548767657\459931797" -parentBuildID 20221007134813 -prefsHandle 10012 -prefMapHandle 10008 -prefsLen 27600 -prefMapSize 232711 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1e696be9-0642-4ab4-8274-1f22be4bf2f7} 3156 "\\.\pipe\gecko-crash-server-pipe.3156" 10024 2bd89492f58 rdd
    3⤵
    PID:7012
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3156.11.1843798451\233082581" -childID 9 -isForBrowser -prefsHandle 10604 -prefMapHandle 10600 -prefsLen 27600 -prefMapSize 232711 -jsInitHandle 1060 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {55c05923-51db-4632-b6c1-b91469454619} 3156 "\\.\pipe\gecko-crash-server-pipe.3156" 10592 2bd89fba358 tab
    3⤵
    PID:7596
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3156.12.222178343\1797647554" -childID 10 -isForBrowser -prefsHandle 4624 -prefMapHandle 4620 -prefsLen 27600 -prefMapSize 232711 -jsInitHandle 1060 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {36b05246-b3a2-4d2c-bf24-956a2153bfe0} 3156 "\\.\pipe\gecko-crash-server-pipe.3156" 4616 2bd886a5658 tab
    3⤵
    PID:8080
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3156.13.676959309\1432200403" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 5568 -prefMapHandle 4756 -prefsLen 27600 -prefMapSize 232711 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6cbce66e-90f7-4173-baed-9f84b3769b3a} 3156 "\\.\pipe\gecko-crash-server-pipe.3156" 5240 2bd8a4e6f58 utility
    3⤵
    PID:8188
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3156.14.864793523\546342140" -childID 11 -isForBrowser -prefsHandle 4336 -prefMapHandle 4620 -prefsLen 27600 -prefMapSize 232711 -jsInitHandle 1060 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {282a7b5a-94a9-4f85-aa11-a532eebbacda} 3156 "\\.\pipe\gecko-crash-server-pipe.3156" 10668 2bd888f9658 tab
    3⤵
    PID:2132
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3156.15.726400824\1621388512" -childID 12 -isForBrowser -prefsHandle 6360 -prefMapHandle 10608 -prefsLen 27600 -prefMapSize 232711 -jsInitHandle 1060 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9749c992-e575-444b-9c3b-fae572845e59} 3156 "\\.\pipe\gecko-crash-server-pipe.3156" 10332 2bd8a904a58 tab
    3⤵
    PID:8316
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3156.16.754739527\921959199" -childID 13 -isForBrowser -prefsHandle 10056 -prefMapHandle 10252 -prefsLen 27618 -prefMapSize 232711 -jsInitHandle 1060 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f2d21ed1-de19-4f81-88a4-62b90a6b9982} 3156 "\\.\pipe\gecko-crash-server-pipe.3156" 10248 2bd88a33658 tab
    3⤵
    PID:6964
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3156.17.1313851291\155886133" -childID 14 -isForBrowser -prefsHandle 4372 -prefMapHandle 4952 -prefsLen 29613 -prefMapSize 232711 -jsInitHandle 1060 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c4c16d0f-b22a-4d61-b1f9-0706ad06f0b7} 3156 "\\.\pipe\gecko-crash-server-pipe.3156" 5896 2bd85dba258 tab
    3⤵
    PID:5868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3156.18.623345903\1799278181" -childID 15 -isForBrowser -prefsHandle 10728 -prefMapHandle 10724 -prefsLen 30157 -prefMapSize 232711 -jsInitHandle 1060 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d8ab0de1-6fd3-44a5-9c3d-eb87ee4e6119} 3156 "\\.\pipe\gecko-crash-server-pipe.3156" 5800 2bd85db8458 tab
    3⤵
    PID:6100
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3156.20.1329664719\1717712095" -childID 17 -isForBrowser -prefsHandle 9704 -prefMapHandle 9700 -prefsLen 30157 -prefMapSize 232711 -jsInitHandle 1060 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d3e8e75c-fa94-42ce-adfc-daa3d1389f34} 3156 "\\.\pipe\gecko-crash-server-pipe.3156" 10328 2bd8838a258 tab
    3⤵
    PID:7604
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3156.19.2083866216\30309250" -childID 16 -isForBrowser -prefsHandle 10768 -prefMapHandle 10196 -prefsLen 30157 -prefMapSize 232711 -jsInitHandle 1060 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {90053a41-ee7d-4322-bcbd-2215902a6751} 3156 "\\.\pipe\gecko-crash-server-pipe.3156" 10244 2bd87bd6258 tab
    3⤵
    PID:7608
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3156.21.1714398161\840207925" -childID 18 -isForBrowser -prefsHandle 5456 -prefMapHandle 5472 -prefsLen 30157 -prefMapSize 232711 -jsInitHandle 1060 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e7ecde99-fc3f-4c48-a9e3-418f3cd099fc} 3156 "\\.\pipe\gecko-crash-server-pipe.3156" 5444 2bd878d4158 tab
    3⤵
    PID:2172
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3156.22.1077959478\1014631148" -childID 19 -isForBrowser -prefsHandle 9792 -prefMapHandle 6448 -prefsLen 30807 -prefMapSize 232711 -jsInitHandle 1060 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7d9e229b-ad06-4d90-b553-9be96bf79f68} 3156 "\\.\pipe\gecko-crash-server-pipe.3156" 9768 2bd88cfa658 tab
    3⤵
    PID:7964
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3156.23.1776660376\213110769" -childID 20 -isForBrowser -prefsHandle 10032 -prefMapHandle 9872 -prefsLen 30816 -prefMapSize 232711 -jsInitHandle 1060 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e8359a4c-600f-4424-8978-b7cff32452fa} 3156 "\\.\pipe\gecko-crash-server-pipe.3156" 6420 2bd87a5e458 tab
    3⤵
    PID:7572
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3156.24.609034164\2116109469" -childID 21 -isForBrowser -prefsHandle 5368 -prefMapHandle 5952 -prefsLen 30816 -prefMapSize 232711 -jsInitHandle 1060 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0c40cfd4-ea49-41e0-b118-2506935895f4} 3156 "\\.\pipe\gecko-crash-server-pipe.3156" 9632 2bd87a78b58 tab
    3⤵
    PID:7368
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3156.25.954396246\1876087213" -childID 22 -isForBrowser -prefsHandle 9704 -prefMapHandle 3020 -prefsLen 30816 -prefMapSize 232711 -jsInitHandle 1060 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {47ab0eda-af5e-4838-84a1-39a9b1e0dc60} 3156 "\\.\pipe\gecko-crash-server-pipe.3156" 10340 2bd87a5d258 tab
    3⤵
    PID:1116

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k GraphicsPerfSvcGroup -s GraphicsPerfSvc
1⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:3776

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
PID:1076

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5164

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:4532

C:\Users\Admin\Downloads\krnl\krnlss.exe
"C:\Users\Admin\Downloads\krnl\krnlss.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3776

C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerLauncher.exe
"C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerLauncher.exe" roblox-player:1+launchmode:play+gameinfo:GggfD5jU71LLbyDx2_2CHROYawWjOaraXA8t7Ve73Yb0FTo8mYxm9uPGWaqaZgGZTkNFnBvfH4sbgzes_opbnaXB_ukE-GSw45DpoNKT-v6UAwsJ1OwdKTBvCJXdOqW19hHJbKX_BP3aZAeK_mkB4SjU9rx7mL2jxE1HkBs65wlzTGAti-HDbL44cKmsfLf6uKPPyaz4aEvwP9LPMjK-2P1ych1hinXB4FS11Igd-2Q+launchtime:1680301678304+placelauncherurl:https%3A%2F%2Fassetgame.roblox.com%2Fgame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D167645108211%26placeId%3D621129760%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3D4f4402be-3e27-4c5e-bc32-9fab71c0ab58%26joinAttemptOrigin%3DPlayButton+browsertrackerid:167645108211+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp
1⤵
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
- Modifies registry class
PID:5208
- C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerLauncher.exe
  "C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerLauncher.exe" --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=zflag --annotation=RobloxGitHash=b30562552e929b28b3892128001fd4fb6e2722a8 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x72c,0x730,0x734,0x6a4,0x73c,0x9cb480,0x9cb490,0x9cb4a0
  2⤵
  - Executes dropped EXE
  PID:8988
- C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerBeta.exe" --app -t GggfD5jU71LLbyDx2_2CHROYawWjOaraXA8t7Ve73Yb0FTo8mYxm9uPGWaqaZgGZTkNFnBvfH4sbgzes_opbnaXB_ukE-GSw45DpoNKT-v6UAwsJ1OwdKTBvCJXdOqW19hHJbKX_BP3aZAeK_mkB4SjU9rx7mL2jxE1HkBs65wlzTGAti-HDbL44cKmsfLf6uKPPyaz4aEvwP9LPMjK-2P1ych1hinXB4FS11Igd-2Q -j https://assetgame.roblox.com/game/PlaceLauncher.ashx?request=RequestGame&browserTrackerId=167645108211&placeId=621129760&isPlayTogetherGame=false&joinAttemptId=4f4402be-3e27-4c5e-bc32-9fab71c0ab58&joinAttemptOrigin=PlayButton -b 167645108211 --launchtime=1680301678304 --rloc en_us --gloc en_us -channel zflag
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:1140

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
PID:3888

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:3296

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k GraphicsPerfSvcGroup -s GraphicsPerfSvc
1⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:6276

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
PID:3784

C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerLauncher.exe
"C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerLauncher.exe" roblox-player:1+launchmode:play+gameinfo:nLd5MIzAaa12OD0pl-zqdYqrAFJZk7HbuGRn_wP1HZYNHpSnsB4rvP5l7TnGUB2S5k6yMBivXoQ9TLVNfTp09qH0tDa-qJBkMGbkG9d543FwCnihJ1Alnbfjj1X_tF-7ZZA3DnrpyRgXRRNl8dDw6WnzPDHYdwqNJHk2ZLj6j4lQoCO6flc4NkILgmTX-7qdqyOk-hsJDao-2jhf11ad_ZTnbPwFlZa_EXxjFx4Sl_Q+launchtime:1680301753929+placelauncherurl:https%3A%2F%2Fassetgame.roblox.com%2Fgame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D167645108211%26placeId%3D621129760%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3D8f77346a-f782-4ffe-8a8f-1b1c917dcf25%26joinAttemptOrigin%3DPlayButton+browsertrackerid:167645108211+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp
1⤵
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
- Modifies registry class
PID:3512
- C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerLauncher.exe
  "C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerLauncher.exe" --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=b30562552e929b28b3892128001fd4fb6e2722a8 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x70c,0x710,0x714,0x6a8,0x734,0x9cb480,0x9cb490,0x9cb4a0
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerBeta.exe" --app -t nLd5MIzAaa12OD0pl-zqdYqrAFJZk7HbuGRn_wP1HZYNHpSnsB4rvP5l7TnGUB2S5k6yMBivXoQ9TLVNfTp09qH0tDa-qJBkMGbkG9d543FwCnihJ1Alnbfjj1X_tF-7ZZA3DnrpyRgXRRNl8dDw6WnzPDHYdwqNJHk2ZLj6j4lQoCO6flc4NkILgmTX-7qdqyOk-hsJDao-2jhf11ad_ZTnbPwFlZa_EXxjFx4Sl_Q -j https://assetgame.roblox.com/game/PlaceLauncher.ashx?request=RequestGame&browserTrackerId=167645108211&placeId=621129760&isPlayTogetherGame=false&joinAttemptId=8f77346a-f782-4ffe-8a8f-1b1c917dcf25&joinAttemptOrigin=PlayButton -b 167645108211 --launchtime=1680301753929 --rloc en_us --gloc en_us
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:8296

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
PID:828

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:7228

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:7128

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:8520

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:3528

C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerLauncher.exe
"C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerLauncher.exe" roblox-player:1+launchmode:play+gameinfo:GcV17UAUaPvzj5ZkpcnNYXw1nx5ng6CfGu2W95AIJNCTZmljkA1W3IvYiJbqTdLUUEOyyqQJc5cIYsldcBS3csh21D_TL-jFh7nOnYK338NEh8L4fSdQEIun0P1KQsV5-ltI1-MLAsk_iQ9tZJhsoV3IOkPYLfZs8WVAMkQMnCEtJNe0-kCJRKhdrUJejlGGn34-GxpYoCO5YiOpAd0Oy4Cp0ydNzdItVeXBU_KAcEI+launchtime:1680301827116+placelauncherurl:https%3A%2F%2Fassetgame.roblox.com%2Fgame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D167645108211%26placeId%3D621129760%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3Daedeb970-2d00-4cc0-a258-6b530ae1d933%26joinAttemptOrigin%3DPlayButton+browsertrackerid:167645108211+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp
1⤵
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
- Modifies registry class
PID:3440
- C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerLauncher.exe
  "C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerLauncher.exe" --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=b30562552e929b28b3892128001fd4fb6e2722a8 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x704,0x70c,0x710,0x6e0,0x72c,0x9cb480,0x9cb490,0x9cb4a0
  2⤵
  - Executes dropped EXE
  PID:8904
- C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerBeta.exe" --app -t GcV17UAUaPvzj5ZkpcnNYXw1nx5ng6CfGu2W95AIJNCTZmljkA1W3IvYiJbqTdLUUEOyyqQJc5cIYsldcBS3csh21D_TL-jFh7nOnYK338NEh8L4fSdQEIun0P1KQsV5-ltI1-MLAsk_iQ9tZJhsoV3IOkPYLfZs8WVAMkQMnCEtJNe0-kCJRKhdrUJejlGGn34-GxpYoCO5YiOpAd0Oy4Cp0ydNzdItVeXBU_KAcEI -j https://assetgame.roblox.com/game/PlaceLauncher.ashx?request=RequestGame&browserTrackerId=167645108211&placeId=621129760&isPlayTogetherGame=false&joinAttemptId=aedeb970-2d00-4cc0-a258-6b530ae1d933&joinAttemptOrigin=PlayButton -b 167645108211 --launchtime=1680301827116 --rloc en_us --gloc en_us
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:6160

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
PID:6724

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:7216

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
PID:3772

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
PID:8972

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:7272

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:7716

C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerLauncher.exe
"C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerLauncher.exe" roblox-player:1+launchmode:play+gameinfo:nkgKTXMNdkhGBsHYwnie6d0cvwYPxC5jzPeSe-duE8UHL584D1HJ65XXXqenHdB0MZjI-WM_VOD4tfSWQP67I__YVTyqt0SOVoEUI2XAZWscWfQYvT7ZPziAr57BBmyObppN9V5S_rg1yyXHi_WFxGqRJFbuHl21A_NPE4i-_koFDNehPwhB-HLmoFJSlPtwmkGFnPrX5nSc9jy6137V-SOinTnMeCKHIFgjUcXBumo+launchtime:1680301914831+placelauncherurl:https%3A%2F%2Fassetgame.roblox.com%2Fgame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D167645108211%26placeId%3D621129760%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3Db7a3c7ee-84ee-4db1-b792-ac549beadfd6%26joinAttemptOrigin%3DPlayButton+browsertrackerid:167645108211+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp
1⤵
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
- Modifies registry class
PID:7308
- C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerLauncher.exe
  "C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerLauncher.exe" --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=b30562552e929b28b3892128001fd4fb6e2722a8 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x6f8,0x68c,0x714,0x6f4,0x734,0x9cb480,0x9cb490,0x9cb4a0
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerBeta.exe" --app -t nkgKTXMNdkhGBsHYwnie6d0cvwYPxC5jzPeSe-duE8UHL584D1HJ65XXXqenHdB0MZjI-WM_VOD4tfSWQP67I__YVTyqt0SOVoEUI2XAZWscWfQYvT7ZPziAr57BBmyObppN9V5S_rg1yyXHi_WFxGqRJFbuHl21A_NPE4i-_koFDNehPwhB-HLmoFJSlPtwmkGFnPrX5nSc9jy6137V-SOinTnMeCKHIFgjUcXBumo -j https://assetgame.roblox.com/game/PlaceLauncher.ashx?request=RequestGame&browserTrackerId=167645108211&placeId=621129760&isPlayTogetherGame=false&joinAttemptId=b7a3c7ee-84ee-4db1-b792-ac549beadfd6&joinAttemptOrigin=PlayButton -b 167645108211 --launchtime=1680301914831 --rloc en_us --gloc en_us
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:7432

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
PID:8756

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:8068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:2132

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:7956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
PID:5508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
PID:1060

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k GraphicsPerfSvcGroup -s GraphicsPerfSvc
1⤵
PID:6928

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
PID:8140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
PID:5540

C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerLauncher.exe
"C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerLauncher.exe" roblox-player:1+launchmode:play+gameinfo:G2Db2NZjtach33MYb_QwRbz93c2Ll6_B1JdQFVm22MihNgjo8YsN8tTsr4zyhKmbYRyTivxzv9tyYSd1vdB7Jx7lrR-tOn6j68tPcgpClsrPVVwrO2ZDKYMSacEdzwgaapG9m48GyDgfxwjZLh7gJWMgK2cxbhqxvnlIW-mjJY9O8tJl4xtYZ9KRSQUvSa0No1JK8we7CEyeub5r722KNPSQZ84d8xm8BzXhe9RmYKs+launchtime:1680302156124+placelauncherurl:https%3A%2F%2Fassetgame.roblox.com%2Fgame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D167645108211%26placeId%3D621129760%26isPlayTogetherGame%3Dfalse%26joinAttemptId%3D72118c41-c4d5-4350-ac10-bae191042dd2%26joinAttemptOrigin%3DPlayButton+browsertrackerid:167645108211+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp
1⤵
PID:5624
- C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerLauncher.exe
  "C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerLauncher.exe" --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=zflag --annotation=RobloxGitHash=b30562552e929b28b3892128001fd4fb6e2722a8 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x720,0x724,0x728,0x69c,0x488,0x9cb480,0x9cb490,0x9cb4a0
  2⤵
  PID:7944
- C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerBeta.exe" --app -t G2Db2NZjtach33MYb_QwRbz93c2Ll6_B1JdQFVm22MihNgjo8YsN8tTsr4zyhKmbYRyTivxzv9tyYSd1vdB7Jx7lrR-tOn6j68tPcgpClsrPVVwrO2ZDKYMSacEdzwgaapG9m48GyDgfxwjZLh7gJWMgK2cxbhqxvnlIW-mjJY9O8tJl4xtYZ9KRSQUvSa0No1JK8we7CEyeub5r722KNPSQZ84d8xm8BzXhe9RmYKs -j https://assetgame.roblox.com/game/PlaceLauncher.ashx?request=RequestGame&browserTrackerId=167645108211&placeId=621129760&isPlayTogetherGame=false&joinAttemptId=72118c41-c4d5-4350-ac10-bae191042dd2&joinAttemptOrigin=PlayButton -b 167645108211 --launchtime=1680302156124 --rloc en_us --gloc en_us -channel zflag
  2⤵
  PID:5752

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
PID:7288

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
PID:4872

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
PID:400

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k GraphicsPerfSvcGroup -s GraphicsPerfSvc
1⤵
PID:4104

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
PID:5540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
PID:2716

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Roblox\Versions\RobloxStudioLauncherBeta.exe

Filesize
2.0MB

MD5
2c3024c6aec09f36db69877db35f8e4b

SHA1
b582af99bd6ba14ae8fd28bc1cbbaec7b4df393d

SHA256
ee27f9cd887945d699f4a3f406e59c49076f38cef50976821d6439c0ab356a7e

SHA512
f2741ada8dea5939075baf3da61462ccd9430c005eb07f3354abd2f686ce83603f401655adb9e990d45808404c3b48d891f7d04e00766bf2904cd12a60a1e23a

Download Submit
C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\AppSettings.xml

Filesize
149B

MD5
48f58abeaac832f838efd2beb25f4c90

SHA1
7878e28b62e5d9bc9042a3e44094e39668f03384

SHA256
893a58e7946728c9dd5caac10e5bdc306a465e406c1f979ded52a13dafebce2d

SHA512
c5e3025b63eead12a0f8192ea41afd1216dd87b14a07d22ebafc6d3d899a06e80da947b3fcd1b3f2cf53b89b3de9967f89c415394d66c277556373b620dc827e

Download Submit
C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerBeta.exe

Filesize
58.0MB

MD5
cd199f81c3a2cbdbf8ede573d6c19013

SHA1
f0fb145f124ac1d299a34ca7efaf98eb946718e1

SHA256
87da9bc3377e4503712a5fa01f1b4560effd3908cf25257f9c639ea671b34a78

SHA512
f06dde6f9ea5bf11d876b117a33f46a8ae5a22ecdf8fc768af4d975b626661e89ca7a866585131b1c4289a2038e8bccd28dee13b570ab4c37e1eef7ee037b08d

Download Submit
C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerLauncher.exe

Filesize
2.0MB

MD5
6b68f3be3850e9b2ac03bad9f4de5b88

SHA1
57c59090e38d6e0128874ed93f53a4e3c65ee47b

SHA256
159a30c008bb234af56a7c786cb5352e7b96dc62fac6b2ca2ea7fa75fc6841b7

SHA512
de8b266ef96aec59987e025dfccd51d8bd91e7e4523c6bc4ccab73de5819b429033da773c1f155e98607d1d60bd63e1b07deca2b454493bd5b8122cc265bbeb7

Download Submit
C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerLauncher.exe

Filesize
2.0MB

MD5
6b68f3be3850e9b2ac03bad9f4de5b88

SHA1
57c59090e38d6e0128874ed93f53a4e3c65ee47b

SHA256
159a30c008bb234af56a7c786cb5352e7b96dc62fac6b2ca2ea7fa75fc6841b7

SHA512
de8b266ef96aec59987e025dfccd51d8bd91e7e4523c6bc4ccab73de5819b429033da773c1f155e98607d1d60bd63e1b07deca2b454493bd5b8122cc265bbeb7

Download Submit
C:\Program Files (x86)\Roblox\Versions\version-be30b823d3fc46a0\RobloxPlayerLauncher.exe

Filesize
2.0MB

MD5
6b68f3be3850e9b2ac03bad9f4de5b88

SHA1
57c59090e38d6e0128874ed93f53a4e3c65ee47b

SHA256
159a30c008bb234af56a7c786cb5352e7b96dc62fac6b2ca2ea7fa75fc6841b7

SHA512
de8b266ef96aec59987e025dfccd51d8bd91e7e4523c6bc4ccab73de5819b429033da773c1f155e98607d1d60bd63e1b07deca2b454493bd5b8122cc265bbeb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Filesize
1KB

MD5
9bf77ce85a5a981d86a0f7a4672ba22b

SHA1
62fb7e9f8b763de11a63a156c847e7df4dde7fad

SHA256
44ed3a7243fe9995a4439683d11971670eb00101c3832ad30db5242560b2b354

SHA512
2ead42546c80b3dbb87ac93f1324c85fc0bfed5a7c51a1217993c18d43886a9e7580a80ba9a2b6ec4c7eefd23d274fce561845ab508b427afc906ad594f58e68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

Filesize
471B

MD5
21ed9ca0f4579a63723066fab3cdb1e9

SHA1
625f8780cba0177fa7d9b747df0bd45511ddc900

SHA256
818a6653f6011a83d251998208826644fe68d228a739c87ec14e470e10817889

SHA512
203e8fa995dfd86617536e1fc445fa1fdfbc0ec462d238cfbfe1d03c81b51c81297335c4c54503070c25897858fbedd659c348ab994f9195635ff75a0f3ecda4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D

Filesize
1KB

MD5
71288df6e69e139111a733ad7b94866a

SHA1
9f756b5bdddb2eae7e7bf2678440117026ea8b54

SHA256
7441007a5974bcfdee443d0c1fe1c40d7e7f454fc0712501eb7abda978877837

SHA512
efab7742dd31b5397da0bf2940e9bb8de89702c39b6f062194caa33b31346ee646a3b4c622e9bc42b4ea9ed94772098476a5e87ccdfd8af0be58a7a153ffc9e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Filesize
450B

MD5
6e16790357b01d9150557d9a45d6a643

SHA1
ca4ab4dee1e9d1979d758cd1912ba907bf789d80

SHA256
d82ecd3c66343c3293258a6202d24a555817e90e5e0e974bdfcb26b081a7c27e

SHA512
d8bd2b198a39461bd42cbdbf787d1c05ab227a9a7c1c71a19d8956a66ffcfb08cd2f97e416448151d09699c65eecf349cd7594e01d23d3dff2355846526c98da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

Filesize
400B

MD5
aaa64df0fa7ef36f804247271a1e423e

SHA1
5259e92c8379cc06ce6f9e142810ec2a8a79f183

SHA256
19e34a97e1a093be99cced60f5b64cc1d4ef3407e18aa2a608784aabf8eef9c9

SHA512
d520209a6eef9f9503b8e0336647adcdefb2f61de5427adc2cd4adab3d3867ddb25f8d7f4e29034d93c3f2f6928922cb67fe248018b082d7f719d23a9c7d9f5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D

Filesize
458B

MD5
0c2cf4cc2c9ef603b67900922fc704a6

SHA1
f26340b9f42b4cce81d7711a68ff64b34201419b

SHA256
8488c3410339feb7c18f697e0a2707b9611903c458ca1c719efb9b5c15d62abc

SHA512
3f760aa5cabfeb9483732b0147b881460e55166e334d7690fb0074137e6309f39b286f2f7ae7a81d363944f81f08aae0338b2e99be5ca0170d95f01f459dd612

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1IYUAPIF\BatchIncrement[1].json

Filesize
163B

MD5
bedbf7d7d69748886e9b48f45c75fbbe

SHA1
aa0789d89bfbd44ca1bffe83851af95b6afb012c

SHA256
b4a55cfd050f4a62b1c4831ca0ab6ffadde1fe1c3f583917eade12f8c6726f61

SHA512
7dde268af9a2c678be8ec818ea4f12619ecc010cba39b4998d833602b42de505d36371393f33709c2eca788bc8c93634a4fd6bec29452098dbb2317f4c8847f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TUIJN6ZA\PCClientBootstrapper[1].json

Filesize
2KB

MD5
4b220deaf4fd3370c2b7ddbb2a541549

SHA1
8a198376e29b37bac2837f8ccedc85a583738ca5

SHA256
d40df69638475cba8ea684bd7bf6bacba879cdcb8ed94dcfbda7ded17af5e2a3

SHA512
1d5f193f9fff2e3147dcdfe33914be803a26dd131bcc3c65b9c132f3c8bcaa0fa2cc81fa9efaed7b6374775a8aa7efd20d13065de483210865742b056759bfbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YYL8D8JJ\WindowsPlayer[1].json

Filesize
119B

MD5
8e7e1124df5cb13bde562332564be4a4

SHA1
37314dc17a1a5635581abbaedff6ab677469a334

SHA256
fca98f982f815aaa96f89bb30515e35e5dde746fcd175fe987d5d885d0a8b4b0

SHA512
2f16df7776ff2d8e3ec1288ecc9f333553e875c2040f83677a1ca0b6f0ad664b957a0a71001f11cd5721a13c1b0a38e1cce29239c772ced1b9ca689b474b1d8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YYL8D8JJ\WindowsPlayer[1].json

Filesize
119B

MD5
8e7e1124df5cb13bde562332564be4a4

SHA1
37314dc17a1a5635581abbaedff6ab677469a334

SHA256
fca98f982f815aaa96f89bb30515e35e5dde746fcd175fe987d5d885d0a8b4b0

SHA512
2f16df7776ff2d8e3ec1288ecc9f333553e875c2040f83677a1ca0b6f0ad664b957a0a71001f11cd5721a13c1b0a38e1cce29239c772ced1b9ca689b474b1d8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YYL8D8JJ\f[2].txt

Filesize
161KB

MD5
43c4152ce7e53f3cbc8245d7b9fd815b

SHA1
682928232403af6464a17b77e53c76ae950d116b

SHA256
d56c2490b0911af5aea2250be29fade40b925d01981ba33e83e37c4f25380024

SHA512
7cb7f0afa3b90dc094ea97e5768c1a94610480ee3bf127f474be33d902dcc0b362ba8b2cbd1ae22d4e6d7e0811d07531b84f0dbc6ae9798452595c4de2d7d174

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\activity-stream.discovery_stream.json.tmp

Filesize
149KB

MD5
27322e5bf84765980bc1bf8642941aad

SHA1
47145c38ee775436231f22c198efec4ee7359e09

SHA256
43304b475d221a800e6b598ca04a33ee431f0e629968a9da69a634858c5cb929

SHA512
87dedb657888627b25bd6a9e17798cdf16352bed8af64320af1130f6db47abb8160add167583a407738115042e47ba568f85dce461c4559b1a81891b2bcbfe14

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\doomed\10434

Filesize
10KB

MD5
a7495b9ff8bf98b7eda74b07dce81954

SHA1
119fcbe24b06e143c14ad4cf0cb780022cc7b3d9

SHA256
8da1f2b8f0ccbcecfc4aba3a5a4996f437b7ececce59c6c7c6c8b13359b36aa5

SHA512
7d309b1d776040a62af8f18c94329adc44e18817a6bdaa161a5d31d997f059fcb64ac75b370baca8ae64288472bd3f58b33da0b9d362b3c79050633de37039d6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\doomed\11916

Filesize
7KB

MD5
c9d02a5aa1d4cd81a293830bb0e3596e

SHA1
412323b688e20d478af437854b979d1369e09dd3

SHA256
cb9de3bacbc32cb03abb8ce918dd52cbfb8fd4dd86904cffe77368adaf3b0b1a

SHA512
59d2ddbd0eceb2d2e431060d90803dee1bb55480c88e5a4cc6883dc5599786c3140c6504203664389916eaee5b06e8b268b27928f8fe2290d2963b4c90945594

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\doomed\14261

Filesize
10KB

MD5
d905435a6d2d888180f13111bf4352a8

SHA1
77efcb9a1cdfe4bee30ac322abe745c6c9153ff1

SHA256
467ee000f59c8173825282b150247900a1023cc31227c3919f5928947068bd6c

SHA512
48b8c4de4a5134c00a59c8f80db0756b8484f198363a1e80ff848b85b0438d132585da53c3678d06753ca99fd5011fe8e67ac54ed10c34923a0e24947e887b10

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\doomed\16836

Filesize
10KB

MD5
6fa6409953bd86096e7ef1207d5bdff0

SHA1
1526d5210db5730c2fe1908382190d0572cfad3f

SHA256
a234bec9a4670721c4164a2905e62f5b74c16f954c4fdc1e60929a37c9484c13

SHA512
51bea9ceb4282f0a54fc4bdf00cc61b666c8899b2e13fc79ebaecb4948d9b525d9bf8d6e6579340eb4f47c188ed2ef601c0ed5ea4c83f3036193df1c5e403a50

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\doomed\17974

Filesize
14KB

MD5
5872b21a78b2ee7f213d1a5605c9fadb

SHA1
96751464a6c44c6225127b00241f0c683f0ca123

SHA256
6b4b827b9ea075691c09516e484b2d203f0f076e5abf94dd1803b93a05834099

SHA512
2e201c9879dc0aeffc391e974f3abf0642fb760b2563f5498f5e12e84fd232bd2ab6d69a0d745ad8437f5ec9ac704cb45ccc5708666fb6af5fd740873ef4a89f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\doomed\18655

Filesize
11KB

MD5
e04a2da85dbb5b26d5073d0b1565541e

SHA1
da3bc8cebc3768a49f58892f953e3944bb84f883

SHA256
2f99239adc8685197895c2ae3be7a9138a2ddff8ffe78e915826c78030bb45ed

SHA512
11126bfc4afdc59bdd7eb7f49f83935ed87d77483d41b9cc62e73cee493e9e6cdce866f142a65d7081dc27f5f21881ba78ff4818acea28b831f78d31e0392b93

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\doomed\18847

Filesize
9KB

MD5
36d257b8b2e5626daadb7e32cabacb6e

SHA1
d0637893431b79f6738791d27b94899db1d20b36

SHA256
a7cfae5839e5e07121cb04dc3fef60ae019d51b358a77fafbccad695a32850ae

SHA512
a06f55079a2d5c3184e8823d48e2d08320dfa2c274078e7b5d955a6406daa6474f972f8ceb82ebc57a830db2f0bcb03b4b3fa2af1df5d53fd6b8b1106c1af100

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\doomed\19000

Filesize
30KB

MD5
9e850226fea79b1099b21def86c231c6

SHA1
a1a7b8b859c554a2f162b8e04892549a729e9c14

SHA256
fb3cd9dbf9a3f785650b66e0fc2d95052ea7255b0e5c27c5cb8ef2200f28d264

SHA512
dafbbddbd67e74afa577042ed02a4cb6edc7d059bfdee2ba57ec703bc3e65e895ce74cc960012843ae9515b08e592b5f96e76036935279a1a6860c6c893cf664

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\doomed\1930

Filesize
8KB

MD5
5a8e803e167e0d2d32661f7a9f2d8e80

SHA1
42335b0c4f319e590e568edc16f4542bd614fbdf

SHA256
095e13afbb8d64c971627de1ac79e99472b1e236e1a060993702efc980299c82

SHA512
bdc95417f55970612e7c23aefddad08060b0af9d9046bb60fb7141d7dbbb348e7a54de11b30d3fc74ebd461a6fb216d36f4b79a3a950f093130ad8f08de98c0b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\doomed\19840

Filesize
11KB

MD5
24fd9861e3f2662bf060a350ed79898b

SHA1
6746f3d22169174ec875cf76a70a29c97692ff9b

SHA256
2cd76f83d32422c46dae7f026c09b62ebdcf48ccf44983e68121ff54271c86f1

SHA512
2e03fff5e38ef4cee06f329f4094138f95365e4f764f6b2e2b867f1d16ac56370d96ab27499b949d4eea1b7a0442e8d8b58580958b140f3dcc74cb585c2f4927

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\doomed\20065

Filesize
10KB

MD5
41266e9d2fd10eebf71c6af0055873d4

SHA1
0efdcf19157691a82910c474f3441480f6e090c4

SHA256
f82cf4b03377de8663eb6696a0b79b8687c8206e62976a6fdc4c980e6bde5912

SHA512
00d8edfed38abd61fb8680014eab9c64ffe092fd8be1306ca5e48676036650fcc9127227e401be7c555208cfd56d6e19021ee542a8c90b193772f14d1c987a47

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\doomed\20692

Filesize
8KB

MD5
20149129780b3e0092b1cfbd230107b3

SHA1
e6c5fb2172d9d3daf756c2916669428aefc9276d

SHA256
8e063b955b01bd429e2c0741053e37841049373ed6357e3cf76e6e5eef952f38

SHA512
2579d65199750757a07f0c367c49fabf2734f0a067f71a008f215c8fc0c1d5f7f31ed7d71c7c16020a2f6a82cc09eb7d95e60ac7f33462a1d278261b6827ab5e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\doomed\22074

Filesize
10KB

MD5
5050914f2618c3e0b75073fafd16b9ee

SHA1
c200644a15164a4eb9d2b5f21ce2c28dc2455c87

SHA256
c35e7adda42cce22c68d671f9f00b07998104a44a46903afbb35f4c61f7993f6

SHA512
8f2e85c05cbfc7ddef4d7c31677be14b57547236790d8547f66892aeb75cc510b9d8e42eae09084b4558f0c15bb730a0acc436980f502e84ec9195daed9ebb8b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\doomed\22262

Filesize
11KB

MD5
d3123bc60641b8e9331c257f88dec54a

SHA1
851bfb8bcc73f2a7ff4af133c399bdaf624bb052

SHA256
4b827a40d40ee805c8fb785eb4ed4b4df8fed2d5d856d631774724442f2cca97

SHA512
cde3f9d1aa0fc767cc243f66cf2e0f1a03f94d82122d236f101d934644a7e904fecb89c7a581b6a95f5d9d929f470355121e6203003c9079cc0ebfb0851b2f19

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\doomed\22262

Filesize
10KB

MD5
73f6edbe5fe37d67e18ec75f34510b4a

SHA1
89235265fb428127f36a1e5d9c3de91987f34615

SHA256
7a03ab2537b7657b9ba49e04e290147c826551aabc69fb209c83084a6e36cc7d

SHA512
02cb71924a1e4527fe371f4a1432a650ed3cb1490c5699945c1157b41bc2fe75717ae68424f4eb3f4f566536103e3238e52ad5c671b124072ca09a871bbf4164

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\doomed\22262

Filesize
10KB

MD5
31d8ebbac4f253c52eddf0c852d3c134

SHA1
1ba99f44e1b559ac7582f830446132f5c570eaff

SHA256
62fe9c71da73d444faf71e421d4ef7da182e8129328724f31c3824bb27f9bd17

SHA512
038cb51bd9c2b6ef320d9b55aa93d1982d7b1c56eab0b8d14115c718c5f2b0392f57d6d6240744f95284ce013717dc3b394b0b75b77f6f1ab6aa4ac610841b7d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\doomed\22262

Filesize
10KB

MD5
05952c45269244adafbb9536ada2a70b

SHA1
e1ed79924a46ac694856b9f48dc954a91b832265

SHA256
71ebf371074468b00d236952123d01c9904d8cc92fbd93d7ec6e1b4ab4b1691e

SHA512
3c0759ff91c4935e6bdd7b590aad018bd06edb8de9dd872a39d847a401ab3a94060ed8b1b4757363b647b6c49389afd95be83e901a2182c66588530b6c3b2bd3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\doomed\22262

Filesize
10KB

MD5
ce9cd21aab45dfbaee2796066ee50dc5

SHA1
027e328464bc810717c36ef5e8b0b82138e3b748

SHA256
36e86b68740c182a9a43dba174a01712abaf110dca38d8a534c29aa083fae822

SHA512
60c1dd202e76f5f971736fc9671401f0e083fc820aa6f2c2cf2dd9d5529d7a5965b3ed22d1572b997eb2bd0ea6d0369ce3fb8e93abc5d526f11c1a1d29877964

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\doomed\22803

Filesize
9KB

MD5
13ea9a01891993c72cd0ce7104faf9d3

SHA1
72dc67d6fd1982f2ce0fad214f555001f2700fa7

SHA256
aed670b95a1245e1d5e912f1e50c53e50b1dace5a47739a83cb222af95a7382d

SHA512
937f86950c4be7244d65d1102dbbff84a078c140ad34f9c18e5d2989a9d8acdcf52fcaecb690eb265aaad80eaf530c01e8ef3a2b4aad02c66d7c562e231ec5d3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\doomed\24393

Filesize
14KB

MD5
3fa3295f4f46c7ef20cec450f2fa99c7

SHA1
b57c563cf345a8fe6ab5700c856af8a01dcdb9b8

SHA256
3c5eb0ce4a81766f15e9c52f272b937237e605276732d47fc411ba99ae17422c

SHA512
d4503f4cb4be50b7ab8a9ff44dddc4ab363008ad2c1ff6ed64f24a641d061a72a0cc0262d69d15d367ea27fb114f5f515149fa34505fdce1ef62f546f52ecd94

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\doomed\25025

Filesize
15KB

MD5
20e227ec5c9b0b92b0d8325149a9c1b4

SHA1
c89d1b1ff87dae8f05c656f2072b4c22f7b0ee21

SHA256
64ff3c361a01ff9e9026b5d833fee6cea8e36c0fc4a4a39ff735b5f07602e2be

SHA512
e982f532ef66c569c902f554d38b3d58a9569eef58d3f2c496d2095865ab3b7f76182e39b80db267bfe23caf11305bff33a087c32a7087c10efef1aaa4617f67

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\doomed\25046

Filesize
17KB

MD5
4406d46ca175f924e1d60d9cbbc45f56

SHA1
3e4ca0143fe195d718b02207ad554a249cc05001

SHA256
2f35b75f22a778ed85b46d6a555ad82f3adfb1345b9c5df97013a76c481ab10a

SHA512
4acf33327b594a88670c654e52976a58205c26879dc76007b82ee5402731f0cf4d1ed2a79783341f1bd0a02725033aaa538bfd836c25d9994454541aaa9001c7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\doomed\25074

Filesize
10KB

MD5
e804a8f59f93e167fc7ab4960599c251

SHA1
89b6c11ea1cc4f4cd2bf5d3b7e2e016d6f5aeae4

SHA256
71bc776682885e3da9b0251bba4c4da39f14bca0f805b840cba6e69292646fc8

SHA512
d62e081b981cf3d03e997fabe52e4c7a86ac19280638f5dbb6062c34cce1940b053b635e531cc49711fc269e6221b088ccf3dbdd7f6b57cea5502c275ac3b3e3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\doomed\26944

Filesize
7KB

MD5
b4435a89215f4ade23842e5ff417e48c

SHA1
5d86f337cf5517b954fcc250df598d3ea7d08af5

SHA256
78b14b8334cc0a0bf5db3992c48aefb6a5e1ca672da247b13c38a6d0b3a8247a

SHA512
030d37f54d673f9006eaf9450accf788c9f6c6398035783fcddc2e30f6aac4ee9fb6953dd59a73eb5e80cb98c575be0f607701cdf2f2f5ed5135171e86d9b195

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\doomed\27010

Filesize
9KB

MD5
b4a7390622f9280f4ebdd44cf3479762

SHA1
b2ee1f8a4658fa7f8861b93faaf16108a79d94ba

SHA256
a7ccd1bf93fb56c47cdfa02c0235ac3fec9def91f92e34c0c193a24cb6aa0f7e

SHA512
6d306385d67c472cba3a38aec5bdf4a1fb5786fa30f89d95e2b42cf4826481f6fdc47dd45b1611bab4ac4329987289afbe34ed9967b1fee4de0656827a56c962

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\doomed\27323

Filesize
11KB

MD5
cadc1f84806ca20429e81271543243a6

SHA1
7796c165a970fad3e7353d555ae6a7ca36f94d4c

SHA256
a64dce95234b04a0d218bff1cbf98ef5cf0a7f353aee46ed56515d336028750b

SHA512
add8e9b4f6df77c4d73ee505ca093048a95db312e438f1fbfb3183dfde08eb21cbdd584b116348e4788d9d24a64e4fab6d46f1e073d68aefdbc1afa7b6e3bf6b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\doomed\29030

Filesize
10KB

MD5
9362c4c0744146239148aad505acee0a

SHA1
3f2b354c13321991e78e1f9585cbfaa69a6d8744

SHA256
b89132388110c211cb76daed8f4535390fb27c425e102f1855944a90e7caea38

SHA512
690506d991eafb2aabdef1bf9fa1a152f4570ab87b5ecc08556b10565c1edf600579073beeb750aef561fb9b2ae3541c6a825770eb6f1e87fc90fbaf78deca51

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\doomed\29715

Filesize
11KB

MD5
a9fbed31e2fb89dd5fa770f24bfbf869

SHA1
c80197ad6433d8075d9e65886306c9a59c5ec6d3

SHA256
58e7433c0bb558cc29145baed4c1cc3065d09d3288d781d8ec1c5d55ba8d60d5

SHA512
64ccd9baea3a9f822446c6572bbde234e818d0b130f2254d475ad4825a019686e1c12659c4ace1040582cba77af25a99fb6a9225691c0d8c136d455058f3b088

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\doomed\29940

Filesize
11KB

MD5
96563fa204767e340be245bef5229203

SHA1
f958403cfc92224d533e93aa836a934b9ad65623

SHA256
24a85c29f210c5254eb4112939372f197425dbea75c687bbc9df07f1cbdf29dd

SHA512
a4cb447574a2bc638b4285982985024531116abdd396057a7f90ab5284f6441c9d42a88059560c48a56702443eeb3d9510ffa287e0a3d2abc312613140b4005d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\doomed\30790

Filesize
14KB

MD5
1c112232a0a989f7184e8e617f6defa7

SHA1
55a183ad010a0b358f6e1d53a4b731ed77959bfd

SHA256
bfc7756190dfc0c86b3283555e2d2a745f8895ba01c5f094690f422bd16070bf

SHA512
ccd2b86cac18ce0511567df227c9d48ffb5c68434642ad1a7d364496b3bb2f8b772546238f2f831d87365921001dca436c2544b5caac7f578db573fe23659532

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\doomed\30902

Filesize
10KB

MD5
d93712b90f5d9e5f75ca823b7e3eb82f

SHA1
661c808de986898c5d5d59fb8c71d55bc678aa6c

SHA256
2c7ca49cc399765a8930d463808743d4aea41c0e5afd76ba81093cfe991598d1

SHA512
9c264f5ff4b318d3d595314143caa4e93bb3b1dfaead646611bb9cecb44514fe3919cdfb785dae2eab009b52fc639c427ebd50484f96e21284d7bb71a0f50b2b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\doomed\32329

Filesize
11KB

MD5
190acb94a2afc7884d89d79334227eae

SHA1
2c269c637ce664661e592c81cd42afed74a7e5eb

SHA256
b44429bdca0e348bc6d968b1fc828249ee18ddfe7fd5c165eb18c910dd3aa89a

SHA512
53b6c62a054eaf921c665b069d2adf79e71466faa51e43f8450c06beb17c5e28d8d13332d30eee1a9e817ef6a97989dd4c9bb9372f6d0b27dc24afd7bf37df53

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\doomed\32713

Filesize
8KB

MD5
478645d23d280770c38f00ced8644918

SHA1
44047a7d4a3ba92311b57f1d119fb13f23146f1b

SHA256
2f2612c882eb071c18a968ea8ae1fed356c78a2af705a8d40198621e53234814

SHA512
062972e8d70345d28106339adfe4dcca3d10e1c4533b44a5013315f67cf6d222aef6b3cd3995e589a9b6acc00f544f17c3a3325ba072e2d3923978d87fc73e79

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\doomed\3353

Filesize
10KB

MD5
510038cd383ff08ce4b7a154037b6add

SHA1
9a0db26bdf7ce3ef749c69bc1db22e442c6fdd83

SHA256
19a3045f4ffd323c25b6ba8e88e0416ccb1b6750a5a1988686a0d51a7517ba72

SHA512
70b52f2298e6cf6bcf2b7231d9cbc3685eb30af316a8d38a7423460e7b37f67b4546531073ea9480d1458571cf7255cae0e40e5402c2fbb27fbabe2fbf034fb4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\doomed\4105

Filesize
8KB

MD5
abbe25b0b681f7f0c41cb6122ab404ce

SHA1
9fc8fb85173129c368e066fd96bc823b6dda359c

SHA256
c594a6a0d4dcc3c6e624eb6fd29a33176c13d7667ee3e7ab2589ff824f9e2b32

SHA512
4dd485e8675f9fd35c2cfdacf119ad64ba541cc4710e10bcff2a6bdb3508f4a44a0b0448d325520745cbe5308bb3b46d089ddb6771a23d5c2cf462800c63db55

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\doomed\4274

Filesize
10KB

MD5
95e81d2d037fad907595cbb66919a2ad

SHA1
0b5268e9433c69945e03075b5094ce747096f660

SHA256
d51d50b4b6d15defaede453067bfbb63129bd67a80607e84c7f86049615852b0

SHA512
ea49afa46b7930c29e08488ea324ee959fe30bc2c1956c4971eea60b74682d0ee764a027631b3c3dfb71b554062e5f79dbb152c5eb5ed4218af8953170c00fa2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\doomed\6627

Filesize
75KB

MD5
bef7e37b36de10e1fc823cd86285646b

SHA1
0ee7c398177abf13207ea7245995e0a7095b897e

SHA256
e885c53ef8e5b1aeed24cdc1e4d59c253f775383b6b4ea0e2762c445ac481c65

SHA512
128b117f1751beace58e25d80158415ceb42da4ebffd2111d0ea8f5a9785dd491547fda6a1442f7c67b3b4a7fa20570a623273d1aea4acfb094867b0fb858cae

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\doomed\9660

Filesize
10KB

MD5
a9cd809885c2a78a40c63f6fde4c1135

SHA1
8bd824969d9b10925bb42e69ce9d85d7805b1b43

SHA256
5c36dc43d50f29668ea2438784b35afb903a739bc39e840eee98801691306c6f

SHA512
be722dc65778e0b466dc6dfdd101ad5eeb8ab5b27ec00a837ed38ae9e7031b15638587907285ecc16e40ed726b6d1a229d123b7af1bc0509c4e9301f2333ebe2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\entries\01388EAB7CC5B2690B4FFE0FCB5801CE225797A2

Filesize
190KB

MD5
56af67dcec0ef64ebd8e04adb6b00865

SHA1
d92b71970211c0d7f2599f6b05669845b7b89215

SHA256
d79a9bd44c81250bd610c3ed6544ef0df80079c09bec6b4f8b8949459ab5861a

SHA512
f2a89944c1db622e3de96ea22790fa5313dee32acc485d6113afb2778b734cbf194ab6a6321c9759610a0aa614dcd775be5f2224d4cd07cd712c0491e9b91151

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\entries\0A0FDA3A4259CCCADED05AB21B00B04A41949DB9

Filesize
1.6MB

MD5
a2cb8b5fab59b847de1088384fbbb6c1

SHA1
2e425ff80d3031dfe845edcbe8eb5c7b5bd7c40a

SHA256
42f0d647e61dec6c761f904f435fc81a41d2a73f6fc31296b54e474dfcc646b7

SHA512
55ee4992bb5d989b4921e6811394d7929769aefd97ea3866169b1d1dad46c23216a576901a61f1852099dbeef154839904cf19f16783980337a530988f807e78

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\entries\1DEA0AA8DDF50849377371E75B8DB782D42D0C18

Filesize
105KB

MD5
8fb4dad6976dc536c6763983364d09de

SHA1
316758fec6d4ca8ad93dd89ad7015919d5540ef7

SHA256
06d9e3831eea78e9cd2162a68165d86666cbce1bd0be65036ef0d1f02e7ccf47

SHA512
ca80bbdaf58f954b0226f88338d04d8733d20e730b745275596e865eafa39117b11b53872a1627e3cb4349c52b530bc6e554ae3ab5c8a585546b8c6b8ebee3ed

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\entries\2FB4453B6C49117B0D2779A56EEB967EEB943A99

Filesize
38KB

MD5
472821d4327cac61265b8a9a352728c6

SHA1
3d9c54af16dbcd6147206a8070f737c3f8c870d3

SHA256
bc092688441c3de248bb48e6edc55bd73f779df40212dadf147a79f81b579064

SHA512
3585f0952dfb0c26fc261587b04d71f5f02e450a4fd3ee7535f4af1d317b172696cea06d406aaa604218d28f0fb6a20549416e7a1fe07d187dae1945ee320055

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\entries\34E9ADDF242E0D127631B69627717274F6E09DC8

Filesize
105KB

MD5
b2e5e5e414285835a48b5358569b4384

SHA1
3e9b6f29a70229f81caeba4aeb6d4a593f36ee24

SHA256
bcf4c672bbb4af2dc073803fa06111d47e5aff0dbcd3ea97e7cd906107706119

SHA512
ca573c695a42388986829bca3e093a36b7b3087e8a1c164f9720410f56cb25f7673771e6c7ec0618bffe069d9576207bba794820d14526f9d09e89bd54620c4f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\entries\355CC3C3210B34A8837B742A876B21CD9312522E

Filesize
280KB

MD5
2ef5015c8665e7f03dc81c5ff48e96d8

SHA1
c56b1df7b42abcd998a61b3bfdf1807f67debd80

SHA256
b8d6190e32658ad7f2cae6f5aaafe315be4468160e09da20475f773f20e3c2d2

SHA512
0da58544466c7adc746a5a220bb3ea9e798962b2483ba57ec995b399d3ed3e86278787a24b66c5913b1e980978e13ed98811d6ffd7bbb76de388a833474d59e8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\entries\36BCFA23A4D04A528CE70EF12214E3995E132134

Filesize
32KB

MD5
277c848828e62c004cd5c74c08195711

SHA1
769354c4d6470db6dc8e6424246b654765f1b768

SHA256
83b234685dacb086eacf0e214424fc95bf21b8062bfa3da60bd6e1a550fc8541

SHA512
1c8613588fb3d20201ceea487ff8339befdc8b4291dfd5cbdab0badeeb6011f44bb2ad5e3fc742ce61b1660925d70c8ef798097ef487f265192384374b608645

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\entries\3B7519773384A22CF6F538938E16FFF2B9AFA626

Filesize
106KB

MD5
8565ec9e6338ac52692b35342ea7e2b0

SHA1
6bfd19ea2217ccbc5f642dcc9864373ca3ffa590

SHA256
76414d59cc7d16cc504a0172a12e87ad1e5f0aa3edf5d73262b898cc7642fea3

SHA512
fc0ae912e86c9279579927ff24e54ebd2b4f4548d1b30e312c8013abe5405778089274b3931d64cba725a3cfdb569d3a4645e50b55b78475cd17304c34f9fdbd

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\entries\3CD97724EBF47B50AE59221DC942CCA5EE96ED82

Filesize
293KB

MD5
4e70b1959fe00d37515c5300b92422a0

SHA1
61e2e05abaa037b9e28cd3bd22889d22657f761a

SHA256
d93d2dea128909b75059fc8c3e58596d8f4e21dc9acb344b69abdb6d69a9406a

SHA512
f1988c67003a66d34530c6949d47be3b20a37e2da1d1475fd3dfc13ce18110ddcf60994d740e7bc0a547da0b356ca5adaa68b268b392a4c08f2222238863afa6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\entries\3D65FD4DBD26F470F7C13A01571B9424C679728A

Filesize
206KB

MD5
e6f20ec5452ab23784ec0e63ef9a959b

SHA1
ffb1336ee57782e371e8b123e1b7f06773f0c4b8

SHA256
62485eed218566df230908d62c25f27ca90833e5de6a203e4a88943aa4f0776f

SHA512
79f4eef1fe9c32888b841265572d97b3089fefacdb945991aa6f7095920798c57653554fb44da9e8dcb1ae39392ede3501d89cd9271a508efd0b31c7a3fa4e42

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\entries\55E5E6FB4DA0D621CA2B27FEAF7A867987DF935E

Filesize
64KB

MD5
f54e9f7656818f48107ad64690dd2f0d

SHA1
3e7fd88d1954ba1b19c9e2c0eb830dd98c39bfdb

SHA256
1ad500e397747202c24fcc4d1dd149d0f4f49f34678d44262cd96954247b5116

SHA512
c8d215a5a6bd3797399010b8d443fa05053e01fc040a97a5083a76d1d99408c1e36e9548042a8bcd8261edef85fd20cd86011c7e7c3204a19deca61b53abcdc7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\entries\6FC6C54ACED261CC5B51B2BE5257D260C9C6F4AE

Filesize
72KB

MD5
f219865286b0a9248f6d1a2cc8b14bbd

SHA1
fa025aeca87c5fb75a05e05f612690cd8c8875d0

SHA256
c13b276018bb2fd906f2e3fac40dcc89ea4d304d8b8e9cf2a0d2aa8c2e50bcec

SHA512
042201dd05dc9c0218ec3c91828c524947f44e83b266f2eac607e9aa284a357f61af6c5917af6846de93c282806c39b3c250a3efc26dcb8e8c46f2082329926b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\entries\703B5EA8EFDA3451FE1A5EA7B2D131F9D7B59CDD

Filesize
55KB

MD5
0c6039ab3dc6486760a3ead3a7e39bfb

SHA1
5f713017a8a687ec80c695fd1f031d9c49dd9876

SHA256
9ba6cf37488817c6998a520ff213fcc3d7b4bbe1f632093a7b22501fe8d2305b

SHA512
072c9f76a0f579f46e4eb07dfd1ac57c5581dad020f3029b74ac00f0a43fcdebf7d7406c895e712d4c9e879a8541f55e8439f64210c9579573d5366ecfe7381d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\entries\70B0517B075A14691D1720E2B7C78B522E5B1754

Filesize
42KB

MD5
3da88dcc3cb4bc3d6b0459c7ea6100e9

SHA1
9b806b869ac20cc6bdeb7aaf587a481626d3b13d

SHA256
7a537217abbc457c814f4a2cea5ab2e33b07dc3e09231c66034447d691c4e1bb

SHA512
e3f963ddc5fcfe56eff43fa2858fc8c7954d4354d31042449a7604a271bd71be79fd70dea802ce87bf5598b16f07444860cbf8164fdf19b7181c5284c933469e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\entries\721790DF4D9265AC47DBDC48C7C63FC594274EA8

Filesize
359KB

MD5
5360242a7d9155128f5b1389fc03b665

SHA1
2a7c7e00ab48e3a0f4ab50f2130a72aa8b88ed56

SHA256
56f843db593e6e93f2caddec05c9eb594012102c8de961eeec735d8ea6545667

SHA512
38e70990b001497500398e25d234019dffea48d19268882bf3b9d18fc9a34397cb18074d696c83192aa8d7d99df096987ecbc058066fc105912a329f7d0cfd07

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\entries\85194067437468C09A1C9DC4F461ADDFC121344B

Filesize
208KB

MD5
9b54ecf80ed12c89df3e1ad30059b8d6

SHA1
3f39275a1aa5f3d48b0876f5fdd1b4faf3f920a4

SHA256
a9a6f6d761ef374cfa356b2ec5f1f8f2a734164637ab492b5bdeb8b01d4e1d87

SHA512
a3bd72cd05b3200d73915225c9b7c9a96aa758bebf72c2c4e883e4732b6e2d90b1b6a9960b2b38ab917ee824c1d7ec4caedff0368ad46abaccd039f31a5af52f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\entries\915AFDFD778016D407EA3B45452B193625D8D25A

Filesize
209KB

MD5
566af5b6c8077343de1b85140db14cc3

SHA1
f1da7137ee88eecdd1eca91a667fb0220f00a1ca

SHA256
a66a3bc3f51b5ab413664bb14c8098ae90a35d967aa55cb185a7de18ebc7bf12

SHA512
86fc0734c1d284403f281d3680a780d0de92940fe2648b311801d0edba7cc00ee23764410f3df3a098d09ee4e96ec0913c26b5329d8dad3b98840c5d41842f47

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\entries\94DB85DFC322E28D2427B5566A6F9F16D0B0E4B9

Filesize
1.5MB

MD5
2f73d6bcf6a37515fccfb95cfdd386b7

SHA1
13ae7a8c9ecf84134092a4d733783cad609d780a

SHA256
46953835be4aa39284a56e14b58905586618c9f2ed593d9273412e799fb20dbd

SHA512
40327e316e03c686265fa6f6af5a8d3092a55bddc024f113ae7dd12db0807d6169fe144fa88957e4546cc4a972fbefc943ceca3902528e8985853398050f9ad3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\entries\96A0D2F1C4ECD10450EA183542E05ADB3BBB4257

Filesize
125KB

MD5
663500b4d1b901847443b9498e556269

SHA1
c62c48b776bdbe7edda10bae8fbaba7df09b69dd

SHA256
9f39b35d1f5ccc030a087dff2c5e31d29515650374937d81ddd6048f8c29aee6

SHA512
8a7c0d11a17e39eb7b6f43ba34932a5c15d3029b9a7d6a30ed701ef3bcd38b7c7b74ec379de1ec10bd60e70ce304f81e345967de5f5d693bd33c4b883470d264

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\entries\977FCB532D3AE56A567B955553E7D12B82D07FD5

Filesize
222KB

MD5
6c1116a3f8c67b4c65b281ae906c1c99

SHA1
ae71ef3e70f3eec9c5552daa11352d810d550f68

SHA256
76c45fe29bdb4f75b0ad508edd8b920187338c4e216dfb86a7f9a6a94bafa1ef

SHA512
fb3c909f07e2db26a204c5e366b732115f5bbb2c726eca8ba80544a15fe896c8cb4c441d07a967b85b6f9b7568eec4aff6e4cc4040168a3b1cd3ea1ed771676f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\entries\9A11F701CA9E2BC6AAD2302AE6DCB2F06F0F1FC1

Filesize
1.5MB

MD5
2eeaad622036dff11539b7411ea0f3f9

SHA1
05ceffdfb6a3488cb4cea982d6f52658d7267f56

SHA256
088faa2abb7192fd33c16ec918746267dfa641fafe8fc7e8ec7b9e9cbd2d0076

SHA512
a0a88f81e78a9f62cbfe2a857e522e5257ff21005528c864ce1e60f50238003d2e5936414d9e138e025e20504a79328155cfab71e92cd42d503dbcc6a45e63bc

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\entries\9D3AE548D127759226F34A95B002AEED29E7F754

Filesize
55KB

MD5
dd91261319f82442745402c9a45465ad

SHA1
64a04fadbae02caa14083093a940c2d75a8d9b1c

SHA256
85097baab90267969d39fbb9dcb2bd61130f42cb28fbc3473aaa159c37fa9bd2

SHA512
621661985b8607ab8bd5e079a41cf8e290bfdfc865515aad26dab43cccada23e8d4cb2ca9d42aa6955b3efa2a6cde71225a3855e4dd1b673feee73981746b5cc

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\entries\9E8A0AC0C07480C226400E47F9ECFF67DFDEBF49

Filesize
638KB

MD5
d41ea9f3bf67313c623aff6afc3a6563

SHA1
eb692f9bc5726d43a7cc2441df1874c70907cd3b

SHA256
41e2bccbceec88213e92996ba1cd75aca28c8beb00ac56c202316745f1c00315

SHA512
4472d1a55a58edc00a53251954f8f9ddd5f0f430d54e762d68e44891054946ce18411cafcb3d397b7f9501b14fdc69c01632557fb6b473a0f2244d169f14007b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\entries\A82DD9725F811DF1BB8CCE3B40E3DA6FD8FA02FA

Filesize
50KB

MD5
4d6b56a778851b0b5510f6fabbe99d96

SHA1
82df31a2e158ef0db89f707525ddd1ce9f0c8d14

SHA256
e937e1c0dff2043525cb57cfe8e84dc8b547d25564e6d13d781491f34bd73631

SHA512
e8b7e8e96d7d4703b549b0bd1f4f34005b67ec095d011ca7ed3b6bf4c86b032bb2398ddb1c98828f3ccb4a11b1fd42f8aeffc23d0b96a91e5d35ac0454a8249b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\entries\A876C8AF86717633E6E46572013B957E820A5E24

Filesize
29KB

MD5
fcc92a2d1b6f37fa24093a3cab66cd87

SHA1
f89ab02894075cc598831c50a92f45bad25e607c

SHA256
2a4f8e13ee9440cb2a58345ed6401db24a438c490f9b830463ef0f5eaf97307a

SHA512
d6153dec7a702fa417c5f03858daa59208046bf1cc3b7e11537ef7b910af37cc6f7e761a36cafb11aa34a287f3e5840a86718a2253bdf9371369c904085d11ac

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\entries\AB0515472184E52CBB1737F145CBDF99BC3C4914

Filesize
72KB

MD5
e579d60d484ae39a8e2419b8bf296b7f

SHA1
88acc5ff48ba082adf5d46928a5fc7865aa5e4b3

SHA256
845332cb0bdb408678d37dfe63173fd735ef9dc0f75b62714daabafd0c5f18c5

SHA512
010b8cbd342c8b805bda9a481379e63f9cffbef88cb68e795dce08dc4b230211b6e1587aa8e1d00ae9e9f7909312210729fe35c5b7b1df7bb2ebf215b4f560b2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\entries\AC5B4849CAB26A6FF5E0D69715FFD2D5203EA01F

Filesize
773KB

MD5
6422727f00689c365be688c02037d1ed

SHA1
c005113dfcc31f460db050d9f6e5624bf9f19f14

SHA256
61003e1f7fa7e68ec6f86bd8710b7976d574748207acbd089e7aa6a3fe32db5a

SHA512
1f98ceeecffd9dab27f0d59103a77468ae559517afb9755e2cd6e3683fcd5286d51da8c1a0fac9c0ca1affe04f8cb4c5644d3b1c565ccff6f343ebb9050d1f5e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\entries\B5D9B00549A67C5E8FDA11F8BBFCECEDD00925E6

Filesize
12KB

MD5
3d752a1efe7cc017e547e613c1b5f744

SHA1
724e4a102774e7b0a87e15882a2ae8d260ac96c5

SHA256
2814d52a8f8a77d2c24f06bbc46ea11be3d013ed172890794998af15c36f1865

SHA512
6bf12671c690fce06a9f622c09f895b9d3b407a8308ed06c9a44ab8490aa334f1a88f637123f35cb8f7f0823b0238c5e0ecc1f4d25359ad5465d4017fc9a0d77

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\entries\BCF18F369C517D29B59C9CD54C63B4BF1B76D0CB

Filesize
578KB

MD5
b446b1bef19f2d455b9d91fd52a4ca02

SHA1
20349c90e1eb22bed3fdc85021dbbd608b03db42

SHA256
21549d04a128e98806a92688d274ad60ac63e3f493ac8921265fd904537ee5e5

SHA512
0a0d5d2388d8c58b2c57c7b662a107c6ec2507dda3ab9c93c763729bb7c9f8108e1ca9d609a62775854e5b10ce61a93caf3edbbc2f04ec3439e86656dce2de45

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\entries\C51293C4725468F5CEA71BE4411050C2DA89A9FE

Filesize
60KB

MD5
58dfba1c173fd51f397602821564df18

SHA1
c4b84ae8e2b0f8df43638a61c86512273e003d9c

SHA256
71f4d39980962ab47404a8266e0a43a6933126ee0a3d37811a1743409266872c

SHA512
731580e62e657e364ce4698fc488520202e21e6fea8b02e3228e0da55ba3f2ca68a6e82c69a5781e43d620884a280791bac18fa5bc6058fee219f508fff3b83a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\entries\CF0B39396412779F06F4DAAAE98299656DBB2DE9

Filesize
417KB

MD5
2eabfefaa51fbe3b31b5f1747521310a

SHA1
e345bfe6d8a59a5c17830c686b30f6692a454661

SHA256
1a19aba266824ed6d9c0eabbf5e1b006edf59709ce40dffb191c18ba2ebfdd94

SHA512
3eb8dcf861b19dd88290592349c5d2212ffcbaadd1e6a06a53073eeeab08fb1480e8b3383f8872df344f53e7213e242d52f42aaff4fe849ffa98aad75ad0c9ee

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\entries\D5594A2648EECD01993B5C42919BA64ADBF56052

Filesize
14KB

MD5
9a15a9269b03d097865c63c3de074d23

SHA1
b16259fa9eaa6b88db41a23bd579f595bc3a2732

SHA256
af793043a67ef30cbabf9e72c707f8c4dbe79c25500064398759fa4735b0da25

SHA512
4b499ceb2c38756ef68939f81f93ece17604a43210a5955d83b982ccc9c22bd53aa82a2e83bdb2b24c77016023e838d4cd07aa9a58d92c1cbde9e2c97e098e38

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\entries\D650AE16FF1E3AC7B6DEEC7F9E98084CF18338BF

Filesize
1.1MB

MD5
3cbb6d1d4008eb5cd3e58c2c8d910bd1

SHA1
8bc8b10bc5d4d12ac6edbb6a833e796938f5b457

SHA256
d2e913c9a0cb2fda2f380ce66464f28989fbd688bbc1513531618a2f4422a6cb

SHA512
a24e36958f9a48ed6c15f37fd4db07a493a9b5a2fe84f71f3452a08535a6cefec4903525dd30c39e027cc6837b6718aa530fc3d46b9f4d53f42ad63dc95232da

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\entries\DA784CCDD74E697C1B9356166222C06487BCEA54

Filesize
107KB

MD5
c9de38a10b6e3c8c277be72f456d36c2

SHA1
16c64e81f08fd4ca3c8834e4deeeabf5dad27509

SHA256
d5aec3df647854322ab97d8ac9e8f6b5eb7afb7149832d67d87db94f407007e4

SHA512
c3f4af0f04031c5906d2c675758586ce2240b5a0d6b88947d2051f6e06c20b716a28cc7eeda6c2d3883f511f95cc57b46df04dd9dfea0c297c374c3700147a9f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\entries\DB01A54323E5CDA374E0C3E72CF9576D5DCFDE0D

Filesize
295KB

MD5
df167f1a2f77a1bceea30f44fac8cb1f

SHA1
b639594b12c7975bd25a9d4a001ed70f97a9fc78

SHA256
d3085b8e0a688f7b9e01332a604a91076949ef56433b80fb23d18406adc09a33

SHA512
fe4608c5cb46bf27c8cb4cba42fa5d2f54f135d29d5bbd8b1fd9fbbaf76521632dd4633b348e1a686ffbfc621e915682b4a5d9ab49f87c49ca0c7e400e7468f3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\entries\DCF2913E9007672914881A47572949E020182899

Filesize
988KB

MD5
297c28886b78ae8d2f4fc7a7ce17b48a

SHA1
df1ff507eeb812530cffdb180a150458c487be92

SHA256
bc135b6d8aa6738dc56d88dc07d63ddf431be7682a07b3e16875927d12eadce3

SHA512
a4de2e91cc50644e7193ea2865f77cb11b14e0b7ac4563e09548b0668bb42d97a7b7f61ad85d91552aecb0904f7a2c3af04b9e29c6b369c45040b980e579146b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\entries\E4135376C57D2895B4C02CB032947FDE3036FC33

Filesize
51KB

MD5
a4433dd41263817d40de1fc09a10abfe

SHA1
e2e11ed8b8cb3a49eebba3b0b69d1f8b21aab38b

SHA256
3a3b391e51155bdd5a1717951ce81922f368f5b2b8518ac2adf36b9d264ac48c

SHA512
b0bcf7484bdab2d3b7fccaadba819d6d0db0619ca2b47388e1b53f4d1d3f7162d8732d72df93992ac78bcbdd3363216d7f249fd69f728f91ed04ccde09d8b718

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\entries\EAEBF10FE7FF4055BADC40F5D94B94B92F32F706

Filesize
105KB

MD5
1d5f5c44d8e963b23ccc6688a26a67e2

SHA1
ea024b3f197f8b62c0b51c3c6c8f1c0e020cfe3f

SHA256
fa1ae951c95c98b4be08b206b37939a74903df3d60c285fde62e4059bc379f67

SHA512
8a1d88e51c81e9d282837298dedc8139f483429c1a616b02723d607f577d9dba70e1d97dd27e575b883e65a249e76e084ff5343be9174671ba18f30f5061dfc3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\entries\F98212B5A8265D3B0F8873519620824758FCBE4B

Filesize
141KB

MD5
9ba17abbea16a565b3dc4adfeaa9bd11

SHA1
62193b809106242854fa130f97615410ddad5564

SHA256
735ac0cd0142bbe1a5a57a4f1da6ef6d937bc35b4696d3229b1a51413f1eeebf

SHA512
79423287169b6f40cac1b4427eb6923592de55ba2c72786443c826ab2755ac678f5b733eddc3fda819180b5e545fabfdf8ed4e524bc950d3f9930437bffd57cb

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\startupCache\scriptCache-child.bin

Filesize
464KB

MD5
5b6d9966d20791c38f3948d133bc4014

SHA1
e033078a3e395fa5ac0c24c92ba9e0d2f9129887

SHA256
181aa6dae48c54c9e5324f6810a4bab386f426d6d90d69f3c99fd03edbb77fe4

SHA512
568ec26dddb29f09c182b16af91f3b908e2890e1c3261547b70550827633719047ca0d7fbc0d2846c7bb1da1ef1a3ee278b4073567348d5d8e02417c8e439d88

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\startupCache\startupCache.8.little

Filesize
2.4MB

MD5
0c65717fc5a10f72894568fd3d824e51

SHA1
dadc2de653455a057dbe4556f092bc2392a5a254

SHA256
ae1c28f8d32fb876916d79f9fc07820b22f667603eb1f41e094018a4b0d3279a

SHA512
31f23584549bec5de0f338579591b7b6fcddb895562e8ae16edf00024ca804072d9b02e2cc064450820d1cf55ea2dab45e3e281edfa68e6d8cb0a8b525e1281b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\startupCache\urlCache.bin

Filesize
2KB

MD5
d96f13e904fa0ac8b2c2dc327e809edb

SHA1
d0b02d1ba979049cef7f4364305c6337202afbd9

SHA256
6c7b2ce59f50a4b4d22362c865e4ca499558c1bcb3a41225b720c749279a9872

SHA512
3c11f22ee0c8a6d7ff25adee19215cf3be97a025a0d9ca609918f4411875413f5bb730196b6c7be1ff746ff1a99f85e9a32653b02bd0532a7dface18be8c2d7c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\thumbnails\d97bedb8f7babe4b13dc18e12f9961c3.png

Filesize
7KB

MD5
4261890fc9ff41bf188914ce183069ad

SHA1
869ff89c6018f0274574ec5d53f3983f7200f2c2

SHA256
3180b535235696e1e2e61b5da2c7c90abed2f72f9c63e5fac6ab7ea6416198e0

SHA512
bbe86c4e855d0713dc6bd85c06c2fb2eb245433f72bd9aed9d4b89fd178e43c521ca626ca6e6b8aaa7dd57b947620d2daace6cd51fa5ef513a5a3dcaaadf6cee

Download Submit
C:\Users\Admin\AppData\Local\Roblox\GlobalBasicSettings_13.xml

Filesize
2KB

MD5
7079da50f17058e14e94287a7f3f5b56

SHA1
b1341e8e590b22df78f235407077652c9f704f9b

SHA256
bea082d9401d3b0f21e28e252b855c1e8491d4b3ef2dafded466948797e20756

SHA512
5647e493d9edc9f6f3671597f2f8b01c77a1f67f8240ccaafbf8effc1a4c9ea93af77aa79fc0b367b6b5ec66f6976efb7632911dd2c9590318ecffc2005954ce

Download Submit
C:\Users\Admin\AppData\Local\Roblox\LocalStorage\appStorage.json

Filesize
4KB

MD5
9af90afc8bd254c1571bd2123b45794d

SHA1
5ed99a836eb79177bded2ef480d86fa05c5af20d

SHA256
16ed80609c4247b7d2ba48bde67289e1364ed0599cecf4df562a6de6066604f6

SHA512
c37c5e648f3aa26123462fafd6ef3a1d2339ba3ba9710775a9e466f47b8e67bac6eccb806268a6384278a2b0391bae0acb6de4e00050b8b3d30fa79cbeee0a1a

Download Submit
C:\Users\Admin\AppData\Local\Roblox\LocalStorage\appStorage.json

Filesize
4KB

MD5
5c08cbbbc3eef509cca19036925709a7

SHA1
7bd20c1068c7e828483109c02701e717a51be3d9

SHA256
d71fa20be5ae2b6fdd6d2d1ac92102642ef68b72cad4fbc2d9f70f78dce79853

SHA512
1d2b020dab98aecd24aadf9456278b55308b0cfa20a4510dd5e6f64d51a0688fe7e1fee07f1a244c0549363735db71c7b6216306b9dd893d9c3b63c71a456ceb

Download Submit
C:\Users\Admin\AppData\Local\Roblox\LocalStorage\appStorage.json

Filesize
5KB

MD5
65499ffea78434a6e0766d3242854cb9

SHA1
1590585eb1e83de592b3b477bed3ed90638d7e2a

SHA256
cb48fd84720f720a07083e5690c9b5eb1df5587b3704398e0f588639eb2e56b5

SHA512
c11784414cbf44e0f88a0fb88c62adde2fc7139fa46b31b77db3982f5becf185ec29c61b4bfa0ea30bc0d19637d14f33cb8ea593da9956e46d99de197fdd7d73

Download Submit
C:\Users\Admin\AppData\Local\Roblox\LocalStorage\appStorage.json

Filesize
5KB

MD5
68aa073e6e44ee7aebea838cd123c2f0

SHA1
ac81284a9c6adcd9838df8d46c679e800bbd5b5a

SHA256
c842d93d288321cfb650ed0a7d3677d9d2ff467296fe884fabe724f6fc106faf

SHA512
2719d1bc9fd314316ae77c6a525e66a0146f3c77b09c1c42085e3f8cdaaf151f72122e9565810938472419db2bd745dff95384bc588f7ec7469f9dd446f8b3a0

Download Submit
C:\Users\Admin\AppData\Local\Roblox\LocalStorage\appStorage.json

Filesize
6KB

MD5
771b889ff62cedaaa7ebd4086492b9bf

SHA1
d9b95354b1ea2bc5b9af322ab832c22d02321150

SHA256
0be1801c3c7b90348f04589ada9edd1392c6696e19cc1c35a6ed81e64d237228

SHA512
423bb94e29dbd0cb07513d505b1231845a3ee4daae15035b3a0d5a36f7195945176a1229df809fba378d2f100e951ecbbd4c2840f4f16bea4d6412a1e3e9c5d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Roblox\http\1ef51cd9a86410704733a9594249d326

Filesize
91B

MD5
21b57f77f2d6c32467e2e9f51ce0d8de

SHA1
d3e3c0d9d377de49ab44f5eca3ea2e0e5d8049d2

SHA256
2f2101a88e0b4875e597e289c68a7300771bf748b52093b1799466c4d548d587

SHA512
899a6940ca76fa46e3a416e254bc516342aa52c59906eef810240e632098b06007b2d9eb7f1f3945854ed8bde65b678201298f5f2b5980d3e997f27cdfe7d718

Download Submit
C:\Users\Admin\AppData\Local\Temp\Roblox\http\22a87dc2fcc1d7f2d4eebec174141c11

Filesize
5KB

MD5
d9d69b76fa1bee4d91466572e137e4c7

SHA1
01ada9ea060c48e69c50e7accb8333266a4f687f

SHA256
d9053d8d6669fbb6ac14f112bdbe190b35d33fd8d3cfbee9af2b8ad6c20e3745

SHA512
ee60e4b58712cba9a6bc6ac2802f913b1ec844f523c720f0cbd014d9ced8ac6f80b74d4bc3d1808bb8150ef3a3e5dd3e59056e5edd2dc8f34ab86d9fd54f78f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Roblox\http\40d449863d2c65cff9cec726395e98ef

Filesize
91B

MD5
28e655898a926edb2eb53e6562049faa

SHA1
0718409b5c457b2924ecf369c9ede3e24d8f7f66

SHA256
d1e7052e1de8fc9b35a62d3762aa287b535624f728e08104a924835a26cb952e

SHA512
c8f00d8392afc2afc0eabdbc7aed896d8417f4ee0236603aef2eeb01f12810b0d0f9c53ca34385526f7c71a60dcf17893958f0e8badb4311545da84028cd6159

Download Submit
C:\Users\Admin\AppData\Local\Temp\Roblox\http\456922e503cbb23f45706f013c27e25c

Filesize
91B

MD5
cd9e344b8bbe3f7d3f391bbb3ed0dbc4

SHA1
4bf73b46440ec2f8438c12a6d70f6d9abf8ba243

SHA256
bc522a9ead88c4a1e860103b0cc55dc34e256cb4700a370b9c34d1602fcdf5dc

SHA512
0f24bd359d36181e7c99a073e39403d5450a47ced81335f1c68e59f5667c92173789ba3a699ae761549465c8da2585ca87504af8583a5f50e96aece9111fa6d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Roblox\http\587fdbc5094596488a9c2f8d402968ad

Filesize
476KB

MD5
f6c76b11825d936bb948bea67fa1de9c

SHA1
4117dea961ae624774c888941ddf68e3dfb20fdf

SHA256
c97ae658dccf9cac8641dbd9f426a03e383376d313c2a29f8f2a7fa334352f36

SHA512
535cb17f247397aeab7d852d3d6bda7c23649b6457859e81e5ba2e567094451f29914e49f7f282d2bed62a02bff1a191a3e84d53d545e03bd6418b682ea8aed3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Roblox\http\5db58565eadad088c291cbd0b658c045

Filesize
91B

MD5
e7589467239bb8fcfc61a2d36d5ee47e

SHA1
1e54661d4a3fb68c2f5f750f8a45c6c79e054a96

SHA256
c28d526deed6eada36d701a672ce8f01b3b45bb0159750424533a618f06f449c

SHA512
ccfb16e57ebbb6ef20dd5d738c67c357380164195a6897956563d519238f4278d9aa3040092094d47fe6cc78b87896f8d089fca1c2e7c8a3f17ff69d7dcb65ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Roblox\http\5f62ede8c1255fd52651fa014bad9a77

Filesize
1KB

MD5
4032f7150f9b5734c6c8fced75fe7868

SHA1
42a11c3aaf1b6778ae8e220a6da286d065c53a10

SHA256
bed5f4c8786d6005d6fd88c9d863eb869cc847ad6d3c5139d90d9297747460d7

SHA512
c6e6d5419551d93242904f3c19777675a5e88a266847a8236461d6b91e78db33f37bb17380eef062d46ad81837f44f746d71f15576c5d78384cdd0c1dce2fed0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Roblox\http\717bb6c4650d17e29f0927602182b4cb

Filesize
13KB

MD5
0ec6cca7929e765b9f929ebb217d5857

SHA1
7e57a26f11ff1c7ce502ce8d736eadb504c5fcd6

SHA256
ac2c737ab7636bb42a63f9883a8537449b80ddf38d083b6a8879b917d538c54a

SHA512
cf456754988c0011e2061971808a802875b497f07afb8f6e360c306bb2b1de0f4fcb6ec05bd473d911110c3770a6fbf0d126c8e41beb10de8a7238b3f39b13cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Roblox\http\850c11a471bfb6038673bb0757888adb

Filesize
91B

MD5
7342a963fbe8b3a5bce98391f7c91497

SHA1
d937946afb025eb344dac220aa2d8d3494c759af

SHA256
3306f048a000d6a897405f05abfd4c6ea181af54c1b77f6db995e8e00a7a17cd

SHA512
fbf1bc5dd2e4dd9a4bda60309ad0a9d891b60f5666d003af712028b28e740f060d6d745f1d33fbd8db95f0d6d8b4f1ba18a8c9622bf52fba1d14f2299ddc4053

Download Submit
C:\Users\Admin\AppData\Local\Temp\Roblox\http\b42d4cda1ee1e3bf777ed40680a48cb1

Filesize
50KB

MD5
8b4f60d1411e9c678d5e854d9d702194

SHA1
89d2141f99d833f849a5b1f1ef92f962cd72d3cb

SHA256
21bcff92b33e716ccc57b0bf599d7412c64044e6e2b0ee95bbd1f1f772bb4891

SHA512
8f40c1ef4d292a0deb5d648e127a3ecc18dd3d6aef2197e5a3654030df9d7ce0d92f5a7d4004ed5d102ceac66223122af4adc7f3f9c7fb4fca153bd133baa755

Download Submit
C:\Users\Admin\AppData\Local\Temp\Roblox\sounds\RBX8BB0BFBB874443EF829EF0529B8179A6

Filesize
843KB

MD5
91190ec01c6cb3c54e727ce9522b7761

SHA1
6b2518592ca5d99bcdd90f86b4ea28148be616a2

SHA256
3c6090298955900fb4754ba9d7cdc324c66864ad3565911d2d53885343d6a383

SHA512
36e28659678d6b206349474040b4a8fe0036cbda6890263eebbdcd086f44c218c27558162b800579a5d0bcb922455e38bdc6689efbc83b57f8725998ff9759b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Roblox\sounds\RBXBFCC926C28264805A54BA0F33798A9B3

Filesize
544KB

MD5
beba73ccd4da6df75139e2c416feb2cd

SHA1
126ef31dcc58aa72b34326ac5eea508eee0a763e

SHA256
8a2b5e40993137b0c35d6da72f32bf16dd912511fa4b8dab53027e2c9fe97713

SHA512
4056d74c319c57194e0414b0738699af6cc0c66b6ea5b1d9b8077d593f6d8f08f32f3363f1298194c568d6a169c806d99a4cd8e112eae48fcf7614c89b384d3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\ScintillaNET\3.6.3\x86\SciLexer.dll

Filesize
943KB

MD5
2ff7acfa80647ee46cc3c0e446327108

SHA1
c994820d03af722c244b046d1ee0967f1b5bc478

SHA256
08f0cbbc5162f236c37166772be2c9b8ffd465d32df17ea9d45626c4ed2c911d

SHA512
50a9e20c5851d3a50f69651bc770885672ff4f97de32dfda55bf7488abd39a11e990525ec9152d250072acaad0c12a484155c31083d751668eb01addea5570cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\crashpad_roblox\settings.dat

Filesize
40B

MD5
c899c01a64c29fcfd238dfddba5005aa

SHA1
8360332cf18122cd817720f361cdc49987a1bb5d

SHA256
7c90926a6dbcdea3275f2c7c288544226629e0b7aa245916c87b1f269fb70326

SHA512
748fd6a2e19b419e272ae6db0877c2a4bf588c989121708ec24aeae1812e55056da32e57b122d694ae62e81fd9e4fb67267ba1bd32534c153d73436066a98f57

Download Submit
C:\Users\Admin\AppData\Local\Temp\crashpad_roblox\settings.dat

Filesize
40B

MD5
c899c01a64c29fcfd238dfddba5005aa

SHA1
8360332cf18122cd817720f361cdc49987a1bb5d

SHA256
7c90926a6dbcdea3275f2c7c288544226629e0b7aa245916c87b1f269fb70326

SHA512
748fd6a2e19b419e272ae6db0877c2a4bf588c989121708ec24aeae1812e55056da32e57b122d694ae62e81fd9e4fb67267ba1bd32534c153d73436066a98f57

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Local\krnlss\krnlss.exe_Url_lebdt0m2poky4a1qa5gityyjqkaapnal\0.0.0.0\4wglo00q.newcfg

Filesize
1KB

MD5
996d7adf80cea51fc652e505b0b7a921

SHA1
ee55843c3dc7ae182cf6df19f159811afc1b4fbb

SHA256
e56bcde58610ad14a2349d376618c3fff220143bf75e5455c330b5659ac170d7

SHA512
701a96afd0baa5375183c9fa00ea991e6bf7f6be89eba6472b424a08120aca030063072cc2a2518c2aad0a406cf3f920e33f069aa2e256f723af240693791cd5

Download Submit
C:\Users\Admin\AppData\Local\krnlss\krnlss.exe_Url_lebdt0m2poky4a1qa5gityyjqkaapnal\0.0.0.0\user.config

Filesize
1KB

MD5
1095b9e0bf3aaa5b23c7e062332505f6

SHA1
a20599df39c391dbf366294d17687721c12ad05b

SHA256
ba49dee9e4938e4fd1d2dfb9a9fa3baa9354e1e1d767831bf46598823c710396

SHA512
e44f95606309a22f2b15d1433257934597a8a213814e402a0aab9f2e4f55340f3f7dfa4fd6517d21255b414ac7e904e5c878adb9c2d98e7850f81cc90ab9d095

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\40371339ad31a7e6.customDestinations-ms

Filesize
5KB

MD5
9507f6b66eae4ed5f89476bdacd6b25d

SHA1
b28dbc667c86732344e3537b2b08a0ebfbbec498

SHA256
29ed7bdbf61ef32a24f88132bf7de9c5ee8b5349b3b7b2c9ac8497b2e183ded7

SHA512
3dce80751673d22433473e7d7c01b073573ee09617b4dd58a306842ad4804f8f34023e8ee3a3215d6c495e7ece54a721ca89c38739bdb00812aa2d9a5a139d89

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
19KB

MD5
ba1528edac78f4e2cede1f0c8e315112

SHA1
a4a9e482b7e3c134e95a0e4bb489ddb33e023754

SHA256
5d360934a997a47611d9f0fbb6c5089985cb2675e30858cb3f6517ceb0aa434b

SHA512
996a6afe5633abc0520807b6d9cb98ff818023c150038194f584eb4614df8e68a3a2d7052c09ff452cd91bcdb38c1adb8b7a7b7cc0b6c62f98b68b4cee28cd19

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
19KB

MD5
08ed4fb991e49db2c41dd5d4cf1a639f

SHA1
e46ae9dfda8e718d191549f5760c5c2bed282729

SHA256
d852b7ed527a949f774c648bff75f5c501d26b6cf680aa47b361804a2eb04774

SHA512
f9c235c8d292e8bec4c1e818fb435205ca2f9a0ea8db2caa17da96ea6d3596460ac2127a66818e0f0222acbb803ff915a0c01f7ed6f4aa29055a0032a3294df9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
19KB

MD5
1f554e721c607cd24d6fa11ae3947eef

SHA1
0df7766cd7e19038dace9ca89f5679851614363b

SHA256
c717e40b5f51034c28158d30244db1701f79498d29acaccce8340ea0913feb3e

SHA512
fba2434013d906b7b7ef81d129753b87cf71af94959b64be5b24815642d51f995cb8d14c62c4a70f1204135d3db3ba6ed1a556550e0c76afb1686f84d92db5ea

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
19KB

MD5
941297ddf959ada26396e536e660f294

SHA1
857ddc86f8a59695998a5b0eaec7014c016e85a4

SHA256
494ab28870cc432198c041a110bb46bfc896a9767b9dd5bf6f064d090929fc4f

SHA512
5be9937ab01053ad094a4ab2d71178063d16fbc92ff56b4bfad6aa478e8452a3d52fc3b152c8a83a73832522b52333c7d55c5161a36c93cd4ae0834b71a615fd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
18KB

MD5
3e31ca431923b2678f52b04f6798f0e4

SHA1
934deb79400931fafcb0d43dfffa4e3b2f2ba049

SHA256
6e137e934888ef902fa0ef3d39493613a69d504ff613c1276c18fbfa91c86324

SHA512
6700c0dcd9a6bce0f733d1b115aa4aa20247c2308240970353bfaceb965324e7c832bbf17d1f514c212cd3fd8a871e8a54ed0f1095e5c9f4e956f2a9defa95f1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
18KB

MD5
08fbba84b6d7b2e27db01be342ad9edb

SHA1
7f1ef2492a9d3e3727b0cefbcc92e67e9a304110

SHA256
b24e6eefb7f7cba47677da7a04eb819da0c2de2853bb83badb1b41ad012f9d14

SHA512
ed3f0af8383d1979df3a8fc8562ae98a1366c0ed26dacde21d1d1ede66d98db562ec8c8c0e9a2864cf5f80d67c84aff989c53a44da72745967c9fe23afcadf84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
19KB

MD5
5693e9a729aabb3d4d984795ab444320

SHA1
03a8e8f01112aa811d3509aeffe9a535be106b12

SHA256
228d4b387bb56ab0a35435ccff8e0eebd47decb64adfb5d6417bb9ff10ce6a64

SHA512
a2d492db1aa47bcadc7fc44b17074c0907c423958b7e65daa3a6750dc86b8fd2f01a068dd6722d4e8121babdb69720cf0b4b1e7f33c065acea4ecfa245393ecd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
17KB

MD5
3676b9920e52a8f4f75b80bbe3f39a87

SHA1
2f95d45565c8787a3be6e547625d6a4dc094eea0

SHA256
146f7e64899f1cd2b8d4e5f9d3feb0e3f0baddafefa00b62fda4683f8a721853

SHA512
ae577defc7af044267ed1d138b2f2507f6b718a46830f0248899b5f009beedb11e205bb0a7c045d9b6e6e4b7512db26b919b98eb9b156bed59ced3e04dc72b20

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\B56OQPEXU077JA8D13F4.temp

Filesize
18KB

MD5
ee7484e812d67a99b5f3250bdca54aac

SHA1
3086c1339a22da13da2ddc4b92a9eea01806c690

SHA256
b014f71dd2200da7026caf709b21fbcbeaeda7029819df7794ad40fed1f3cd3b

SHA512
ee65fb10bbe4df871daccfc6679794006e9311494380ee9e365dfd9db481285992a6fda8c5738436a22e218c84144276b7fb46cb7a6fd9d778e0fa60adf6ca86

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\crashes\store.json.mozlz4.tmp

Filesize
66B

MD5
a6338865eb252d0ef8fcf11fa9af3f0d

SHA1
cecdd4c4dcae10c2ffc8eb938121b6231de48cd3

SHA256
078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965

SHA512
d950227ac83f4e8246d73f9f35c19e88ce65d0ca5f1ef8ccbb02ed6efc66b1b7e683e2ba0200279d7ca4b49831fd8c3ceb0584265b10accff2611ec1ca8c0c6c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\datareporting\glean\db\data.safe.bin

Filesize
182B

MD5
c58234a092f9d899f0a623e28a4ab9db

SHA1
7398261b70453661c8b84df12e2bde7cbc07474b

SHA256
eaec709a98b57cd9c054a205f9bfa76c7424db2845c077822804f31e16ac134c

SHA512
ae2724fc45a8d9d26e43d86bcc7e20f398d8ab4e251e89550087ace1311c4d2571392f2f0bed78da211fcb28766779c1853b80742faa69f722b2c44c283569fd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\datareporting\glean\db\data.safe.bin

Filesize
182B

MD5
63b1bb87284efe954e1c3ae390e7ee44

SHA1
75b297779e1e2a8009276dd8df4507eb57e4e179

SHA256
b017ee25a7f5c09eb4bf359ca721d67e6e9d9f95f8ce6f741d47f33bde6ef73a

SHA512
f7768cbd7dd80408bd270e5a0dc47df588850203546bbc405adb0b096d00d45010d0fb64d8a6c050c83d81bd313094036f3d3af2916f1328f3899d76fad04895

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\handlers.json.tmp

Filesize
439B

MD5
6744af7e249c7fe04774492eeb4a7c8c

SHA1
e1c21b64b2fb0181a5309c1bb2b5de477fc4bf28

SHA256
2cee6554a5acf4ae1a67cf258ca73443656828f7dda1a5f0004dcb7ab77fa680

SHA512
875661b98dbfd0c6bd574868f2511fbd56fa98cc8e1f3b901d8e41c60d93cb9de1bc8f48524043eae4a55ac5bc1090a58e3a9a5f0d6bac3aa16ddf5f29dbc050

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs-1.js

Filesize
7KB

MD5
385d62fa96dc4683112283eaa386665b

SHA1
11322f6e862e686847807c30fadaf4e8f9160388

SHA256
d58d8d28e1fdaf7aeddb9caff6d59e25fa9860a26a3d90321f0d7c923663fbc6

SHA512
e33ed1ec0d16551b5b65f84bd00262c0741b8c8d82ff286815cc7524b50f327180b20bfd01e6ba925e3a96a2898fcf0ec1a5ced15d430daa86e723b4582a1da8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs-1.js

Filesize
6KB

MD5
4584af64b9a89499017e3e76e455fa69

SHA1
9dbba40be2dcc688a19416fd75e92b8a74577acb

SHA256
d3a0dcfaf122fa70189cd24a241617fb2e94af6c92de19a572a46941d8901282

SHA512
495125cfdfc3f914f5fa04e3bd03987676b2f778acd7aa8cfeed9584110e5a7f07dbd7fd34fda0fe7945dc06215f8b27c078d56a531f50d1fcabfdbf265b342e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs-1.js

Filesize
6KB

MD5
9de460339b7a4272b51f9638d414281d

SHA1
0c2ce1e80fba3812a9755d6faa5c4cdd8ece5bf1

SHA256
9746164ebb52078b40e51ff52e61093e09090a9e856af011de905f5c22d5feea

SHA512
be1ada0dd098861d835a37b948d6fbd0060375367e71cde3dab06408fd5fedf6b0ce7a37829d6f99c3074148205313c04fd13c2d1e748fc8684810296c65914b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs-1.js

Filesize
6KB

MD5
2a684bb2833ffb8d63adf04895b6fa3f

SHA1
d10b2c5e55e076f289c42f2d4f1937e8d91b034d

SHA256
961bbd1bd034320243531cbcf6de88817eeb6e5a6e995ae6feb9067beef22318

SHA512
ab4609bc561649db29128860bc8d9f081c21317896a3ebbb1a0fd8bc879cdef2f132dc3fdd1bc5bea06836b889e9052b644a7ca3b7d05afed0293f6d468642cf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs-1.js

Filesize
7KB

MD5
1aa0c46ce1d595660aefc148a8f7ade0

SHA1
be253d744956113342bd3332aaa5dfce9e7ac6d9

SHA256
5a0ae8f5bbd3303dcaf0db16b8e5a3c613a81721aeafb21c22e6d2546283a939

SHA512
3b24239a84d47dd325436c9e5bf75b1271f4a0a8841d02dfc7a0c40eceb5919859db55afd49ae0068c94797805e2675e2df33049441995d23c4a93e85c4254a6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs-1.js

Filesize
7KB

MD5
2fa4d9c6c6c5a73e219a508eb1e261fe

SHA1
8cc37526873361e33d2568a424160774a5fde64d

SHA256
6701cb9d8c8b0649981fe3ca62459f5daa78aeaa0cd56b6a94dd666a497886ed

SHA512
e75157fbf6a4d0fcff1090b1645f53e28c5c4e18bae6dcc4762223ed5d88e224c802ccae271e8b7dc3f28d108d91fdda961592970ec0192cfc0521bc3c7dc39d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs-1.js

Filesize
7KB

MD5
deb74aad7d9fa1f5f7c58724c41614b8

SHA1
1e40f0c962ce963842bcb6d426e293144970e3de

SHA256
d8cbf5a62741a86bfd4ab8d6ea95370616386a078cb6b466713efbd08be97afe

SHA512
15ea3375d1ba305e5d23dfd2c50df4a812836617d214d6a34213f6aa6cc4977e27b6c262696d522f12194394d81e3e7227c69239d01215012a3516877deeb567

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs-1.js

Filesize
7KB

MD5
b94031024c167724e89406ad9e02d142

SHA1
94fdec15c76278298503bc864d1dd47853817a9b

SHA256
050ab78b6be6a2ef75d2f7bb7fa9b2492ca5bd7a2cd5576098279ca72d13968a

SHA512
c135d875c0d6f424fa20dddec6dacc36122607f0cbdfe380ca1c03c060a15d516df27215a0c8777a86f9c1c5a3057a416622afcebc8387b06ec2886647ee2f3c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs-1.js

Filesize
9KB

MD5
beb1378585cbdc14cb5232da32208233

SHA1
848f060990f2b6c613c03b2397c0cf00e8da4787

SHA256
30290e2d0f7f5c4def59076013cbdea177013b759d9bb0546da807badb41e7d5

SHA512
63499e624ef6f2ff46be72e4189e9a6f7b5e3e3fb21dcb95d7820ba465286880c82af6c11ab42cc89acf6b3e28ded420e2a84ad895108f71685da0bb794f866c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs-1.js

Filesize
10KB

MD5
c7a1cb8cfa79139e3f813d9536e72765

SHA1
0d2626bdb34e277af3087bdbff36612dd3dc9e05

SHA256
d203a7e3d0814edc3ed4bd967766cea2800f680c43c7d51e26107aeed8544ed8

SHA512
8ee06414a19bc0542458a1edf672f6c304b88e599f541f4ef29ada7ba394075d6940fbad0b6b2e736b4b8fe825081413d52d21eaeea31d8e4177366ef33fe9b1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs-1.js

Filesize
10KB

MD5
6fee5bcecf3dcd25f1d095c3dbda9060

SHA1
80870a28427ed2f22fb67017f453d537932f40f3

SHA256
9a4ea538d11e84c889f92f0bf4e7b025f1a91e24c431dac5da2d12624825c4e8

SHA512
0809b3291e8fdf659ace7c21a0be1f13092d78bacd69625e1585860bb521e64597e2540b5d6fe53c4f33e1f62a5ce9852acd01b4daf2a05884647af21ec0a09c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs-1.js

Filesize
10KB

MD5
1d8db4bf49c3ccc834c96d0891f0c8d3

SHA1
8e00e11fb1aaa49951f3972c87dbbc5efe48349c

SHA256
1752c0dc007d058a382df4f5ae5957034ddf6154bd1cbb361faa8bf0b190a597

SHA512
fb7d32d5f96b84565d84dbaae16c516f71c1cc3b2cfc78ab9d363e483c1043316639bbe68c31c1990fd45e09b9f600ec1d44ab24c499b98ce56ea85552ddc465

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs-1.js

Filesize
7KB

MD5
510f2427e815fadb801861dab93c7f5b

SHA1
d4683ab202dd2b664ae709e8d1b92e2cccd4796e

SHA256
863ebc9cf3a188298767beba3c1f0d828da374e074613fec9fac63a9bba9aba5

SHA512
33a5442fa3c535da5298808500dba82a1ea90c3c4fa61475695a9fb98071820d9e1977319e14b60225813093b44d301710a38ae57baee7fe4bad9cab31906c9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs-1.js

Filesize
7KB

MD5
31d894df9ba194a019493127d62ec325

SHA1
cdd16311447a45d6ce32b130748fd8117c033d71

SHA256
e58e6b60da819ca472d868263fd1ba9c60e67385c4c63ffa322e0fde4a0f8886

SHA512
f5e6d184fcd81ccc96318e311cd0c6fe124cf8b785a2e8b4372ce5e4f464206d39a78adc32f1c600bb9f8511fcaec78a5b808f9796fcb5ca434fb510be53733b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs-1.js

Filesize
6KB

MD5
1fb523e7a1f39226ad74f9036cd38c27

SHA1
f3e728ebb3fa9dfea1fcc8ea0128c84c70539169

SHA256
3892e529fb0903dda5921fffc72b36d7bce8d2acfa664938cb99d8762a85daab

SHA512
e77fc7d9e254f3ae28b8f3339bc630f1ccad897faacb4237146fc370ff6c1dece3917f554e8f1c3004d72f7d392c4977f2ecffe639d3dd748bc593b73d9af825

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs-1.js

Filesize
6KB

MD5
5bd289dfee4e1c9937ad9b76467d8700

SHA1
008db21f4ba21a782c59e43c5bee875252c35db9

SHA256
4b3b37df9405e600d1fd641b7a970281573e602bdafa244014f744e253dca259

SHA512
3ba93922afa3707ef761c81f9e19d010f850d0c635a611ed15f86a1eb5c0e89a4e449953f43de4a54b7e94f40b6512af098ed29cfd3b66918331d447e7eb13e4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs-1.js

Filesize
6KB

MD5
d067aa33786ff5ddd5bd11a49ef4257f

SHA1
161b1bbe2e624c4ebb6d303e8d985e2e23e60ff0

SHA256
73bae37cfa0e5a7e8d05d4d38e019dd4d3b51e3e70068c68ba47c0d1b004e0f5

SHA512
752a7489942942c4289294584993c3d4581daa6131ec3dc7932a9a2f39e76f3fc36cbe3173dc706594af0d3b829d8615bad720775c20c78133e5d3c4e688489d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs-1.js

Filesize
7KB

MD5
aa7bc5522aceb97e8d3343e17105d543

SHA1
026926717f19a93ac5515ca01fe84ab9c388bcf0

SHA256
0f5b69905490e6f3425702cae462268979bcd323bafc1e12a11d393419a012e5

SHA512
d43b1ef3fa97732253b4cb291888bddee870a52c728b120467cfd1cd19b63126de8c12ff49c1349042a71b824c746476e9e9e31443b724c49cea4563f1b5a15f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs-1.js

Filesize
7KB

MD5
800a3a744679119b3c66d116b8e6390a

SHA1
c8e0ba129ce070db4d2253dd1418db891a2ed527

SHA256
1e9d4a93a43cf2b2271946b8d2ae816c66da4a14e03cabef4dddec807f560996

SHA512
debd3ddc98e48b81a0a4da3277ee356e50f5c7c09320620600d3d77465f6f9a800c14f4db5698f2aa46e94a8274a1bebf8b938bf2506b03ae513638e93e7806b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs-1.js

Filesize
7KB

MD5
e53fae72ef9bee917475110d036cb215

SHA1
455c96a8b19e67c95071c75f114b5b42a0d3b6ba

SHA256
28135c8d0e4cb20f78c1c0296c564b07ce6e06eba715cda99be980b88ce4fa74

SHA512
89b99bb8fa4ad2a2ef2aff39963886d7aa6d00a91ee3568e61e3c18a3cf2c89573426d970602de7bb593937e2cf02195e62e841b831c476d7de72b70dd21df1c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs.js

Filesize
6KB

MD5
1984b45f201f1fd79d2154406648433b

SHA1
42f082dc6d4d43333688690bf4dfa7c7f8b618ab

SHA256
000a408519010d12b94281710f9a987f822093a1efb5293bbb50ca2e4a6a9df9

SHA512
e73a00cc8994d4023168e93ff5f5b6e6b13ffeb740872b64f565787cbb57e49e64eb03e4de1d8068a6f303f0615749fb27cb47bdbc4cef3fef1290bd3a3a17cc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs.js

Filesize
6KB

MD5
1984b45f201f1fd79d2154406648433b

SHA1
42f082dc6d4d43333688690bf4dfa7c7f8b618ab

SHA256
000a408519010d12b94281710f9a987f822093a1efb5293bbb50ca2e4a6a9df9

SHA512
e73a00cc8994d4023168e93ff5f5b6e6b13ffeb740872b64f565787cbb57e49e64eb03e4de1d8068a6f303f0615749fb27cb47bdbc4cef3fef1290bd3a3a17cc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\serviceworker-1.txt

Filesize
358B

MD5
30fdabbc9a8af5b77c319f2b189ed92a

SHA1
c791cd52552228387dff46d552038cf9ea076e8d

SHA256
26c71030c294b6111f44eeb03a84db47052cf6848c2ae7ff1a746877099829f6

SHA512
b8a1d66d5850121bbde038e3a3f1bec7497b368e51df9e0476f25a3c8cfe48426ba103194b3c1cb82ac172ee9896a1e08720cafb5518b8f214ac36c75a71025c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\sessionCheckpoints.json.tmp

Filesize
259B

MD5
e6c20f53d6714067f2b49d0e9ba8030e

SHA1
f516dc1084cdd8302b3e7f7167b905e603b6f04f

SHA256
50a670fb78ff2712aae2c16d9499e01c15fddf24e229330d02a69b0527a38092

SHA512
462415b8295c1cdcac0a7cb16bb8a027ef36ae2ce0b061071074ac3209332a7eae71de843af4b96bbbd6158ca8fd5c18147bf9a79b8a7768a9a35edce8b784bf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\sessionCheckpoints.json.tmp

Filesize
53B

MD5
ea8b62857dfdbd3d0be7d7e4a954ec9a

SHA1
b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a

SHA256
792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da

SHA512
076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
29KB

MD5
db5642a91322aaa8cae55b6ee7a0f7fc

SHA1
996a430b9731a6ea36e8d045849a191267e84cf1

SHA256
69f90bc5b0f6e85fcc66b9bb934f829a73a2ec6eabda3adada63d8561d6b6227

SHA512
f32a73ec8510b71dec950a09646df952dea7eb429debe560f1cea67cbf41f199967b8c8c4c275200709bd7e7440bf40f0c71830c02837dad7ddd7bf91ccc8ad7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
29KB

MD5
5684a5f79473a5424412faa078c83f5a

SHA1
c64675a36888e376b3f2cdd40522b5e87ec07b85

SHA256
bdfc74fd9470d626907811838d463d81e531bf2847b700cb271f17483076abf7

SHA512
b31848db61dcc4266122bdeac272cacc4aba77c57586d7dbe32a879c308147cb0e7057206e869938c19459124b23d281333ec8337b63016359a360d9de516a95

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
7d5ea6207c5e835e70bf254f61b7f0e3

SHA1
a0d33b4863d60eb5934872e1f18be6c6ec6ea03a

SHA256
9e412acb5aeaa59c3f930d2102f7091a676123868502c5f2128e521b7c66bd0a

SHA512
901f9ae7a30f5f5a8284cb656a73a810a4364986881ebdc25d3fb0264dee17fabcb11daadea8d7233a2e781a2a90b866f8d5c77877ef0742e566011482d3f895

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
11KB

MD5
ea188c8360486238373510a5f332639a

SHA1
91a01894bc47c0e2767219f362079e5bd6602270

SHA256
0e213c891b96d6d194e0ffd6acc4185c811d4d44ee97bf87ea7739e66852c832

SHA512
924ef74a15aaee2c91e107bddb272ace39d34ccad93be1bb11a417e07f046339217c2d9ed2ea567b59fbc3cb0fd3463400c5ed550bbb3e16b902222858650be9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\sessionstore.jsonlz4

Filesize
29KB

MD5
2e6158a1b1dca82b57dbe8cd741d3b5d

SHA1
d8d184c6cac945547abf92566af91d9633847cec

SHA256
c77225f5aa9236a6398e3460474bb135674c9a7f058febd56e09755259b7c17e

SHA512
63bbcf26b6f6778a8321e82a2aa234e69700fdcc6f15f97f0cefb5ef2d2181d1b4e77aab26882a500aad9cf9faafa8af2ffe7e76d7ed33cf96596fb95874603c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\storage\default\https+++www.reddit.com\cache\morgue\116\{b51657ea-c763-4cab-bdfb-1d376c7d5074}.final

Filesize
3KB

MD5
3bb4a1da4f5540f331ab94001255b437

SHA1
65c532d38655a2889c0b0a62005e2d2ba871e8a4

SHA256
e4a0e7412a33b9f02806e18940eafeb5e45131eee18f78b0068292be5a6e55be

SHA512
fefc7c48726c9a2253af8274f588697bc60e18a05d8b08bf8424cfdbb3c702b7fa96ba29776baf2560da5c1bfb5f1bcb5c19e5a72d15ad5533b8f69a0078e8c5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\storage\default\https+++www.roblox.com\idb\3140325527hBbDa.sqlite

Filesize
48KB

MD5
776fa10fdefe5aa27f3d84caaac1f556

SHA1
1d88be01b42db0115c21c4ed2cd3489b598ef8ef

SHA256
1d99b3b23cb3b3b3894313426d16c46ebc22042742f4fbdf74782cf0929922b4

SHA512
9f9e60a3762741e7f032dd22ae786b47ae4d7e1c04fdcb99e53623692a3050d972374e9b468d08e24b1ef9b5db429fd0ab0e1c204e6961060a1f33b2527ee342

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\storage\default\https+++www.roblox.com\ls\usage

Filesize
12B

MD5
b4f903b77885c8e0169e4212d84ffc8d

SHA1
803b87e26b56caeb9edcb9ed1808e9fb47e0ccf3

SHA256
c196f0c84274f05637e13c3ff6c11c56c39e270c8a7e5dfe959998128fe3f1d1

SHA512
c58992b788a0aadcdb484a9b2d57bb8895da20f209f137609a90b65fcf89bce961910ce029a84349d87424f844de4557e8857a9c5383ded7a1275443925cf86d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\storage\default\https+++www.roblox.com\ls\usage

Filesize
12B

MD5
49bfc1474d9fedfa972bf1cca0e33325

SHA1
ae5f4146107ef4ace1d73e0583b0f0fbc0e795a0

SHA256
a90677f40f122dc25c1e2611bd2eff031bbbde359dd501c25dba87cc2baff97c

SHA512
3ea85e52fe01ec315d917f9ab35ae2ead0ff45bab7dce3856d739c326eb495af1eedef2e540cdeb640c39294a32f4aea7e8bb5166e1490d51e9553142bd070f8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\storage\default\https+++www.youtube.com\cache\morgue\17\{398ecebb-7c10-4fad-b92a-d6ce992e9a11}.final

Filesize
3KB

MD5
cef537b58e98894acdeffbe7b58132da

SHA1
c8c432653b71eab0612893e6f6ca0dcfedfd7c48

SHA256
a8c2a4f73da366124275d47b202fd50c1ec3c06ec62ffd03fcdf58de1927ace4

SHA512
13274edc0fc70459df34642bcd5d74a3b511a24b916c5b1f211b84dc5bf66112561e43fb2d8462b975497727e6ebd577a1056f04eb2299799cf1d4811aae395b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\storage\default\https+++www.youtube.com\cache\morgue\237\{f521c102-de91-4a71-aad9-a3b6d84966ed}.final

Filesize
64KB

MD5
e1f93f9cc564b5a227aa41b797261cb3

SHA1
98d500996d18d5d63ae3a35a2e81fb78176d691f

SHA256
54cdae72539f281a758826b0d190ad34eaad2829d339e1a2389337d369b1043a

SHA512
ae570fc5a69a7e3bc2f0ec194b3599a07acedf2ed5230581188c7bd7311c7b5a4793b93eaa936e1df3c17d0526efffedf4f5e97098a5cb372c53afa687d04e0d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\storage\default\https+++www.youtube.com\idb\3211250388sbwdpsunsohintoatciif.sqlite-wal

Filesize
40KB

MD5
c06350008c35909bc02eb44b26a7b222

SHA1
6740c05b4b2e7f93a686761a658373e99fdb8b8d

SHA256
31d251b0e686d8044008a1ece15bca9a757351ef577800ed35adcfdeb54261b4

SHA512
dc03267623235a719c495d6c7b34e0d2a4a7fb00c77a22f4a7a12ad1f2166f6bc5326812f655ffcee49ba53add94df2ff1d2f5dd76ab4556f8a1810bd8dbe7f9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
896KB

MD5
a984725dda80c48c890f7f7001ccd38c

SHA1
3a1af091716301870ac7350bd452ead97c14890e

SHA256
210af6cf6d1b331a1263799dae3fe4d9c32b6b44205eac3644f82297001dd060

SHA512
8d44a9e434578603c399995f771040e2dea7a36faa57fcfaf5b952a639a58798dde09c07b255b57bb1d8d8a91ec8179647bf83fa6ad1c3e3cdd71366b6a7c3b9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
896KB

MD5
ed0e1d43fb6e4a649ad88800643ba3a5

SHA1
2a4136b13ea629134637302d27a490a92e31cafd

SHA256
039bf3cd39bddf60a06d977eefda12a13e0fedf4d7b7ab69c189f656c207232f

SHA512
70ad6347a368ee49682df15fdc946a40b7e25f9652c388a39f67e3d12818402aefc46cfaf48442e66dede708a7cf348ee4c275f896ca27671bea972aca678a0d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
968KB

MD5
4583db0da4a7d72f9f25178726914933

SHA1
2b701e08292141115b8e8695b5929823975df1e0

SHA256
60842da113731ee3d0133699f4ec4db2d94ec8c5e12157756499e66311fd367a

SHA512
ecb4f8d999d5c0be9e3d06c6b62447182100ae6d17742b8d95f86511459f9f80a485df604174aa5ac2f9021027d779cc9174e7179cb429eee8304858b973f068

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\xulstore.json.tmp

Filesize
217B

MD5
6d87256a2b21b9603b7d731eb033b9e0

SHA1
8e2603f254af21d5dcf310fdb5a688e9097aefd9

SHA256
5b3e57bf27b98cae50a753101df9a00a1f6d96886c1a92c4106a6f7eaf6d09a2

SHA512
67bfabf0b5d3fc75b5223a5da836e6909b2af8d98172120fc5efc0b0f6ece72b6cafbdd97ac170bc5357d85a39b15fda7e2df861981d193f84cfca82f360e156

Download Submit
C:\Users\Admin\Downloads\RobloxPlayerLauncher.Rd062QkB.exe.part

Filesize
2.0MB

MD5
6b68f3be3850e9b2ac03bad9f4de5b88

SHA1
57c59090e38d6e0128874ed93f53a4e3c65ee47b

SHA256
159a30c008bb234af56a7c786cb5352e7b96dc62fac6b2ca2ea7fa75fc6841b7

SHA512
de8b266ef96aec59987e025dfccd51d8bd91e7e4523c6bc4ccab73de5819b429033da773c1f155e98607d1d60bd63e1b07deca2b454493bd5b8122cc265bbeb7

Download Submit
C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe

Filesize
2.0MB

MD5
6b68f3be3850e9b2ac03bad9f4de5b88

SHA1
57c59090e38d6e0128874ed93f53a4e3c65ee47b

SHA256
159a30c008bb234af56a7c786cb5352e7b96dc62fac6b2ca2ea7fa75fc6841b7

SHA512
de8b266ef96aec59987e025dfccd51d8bd91e7e4523c6bc4ccab73de5819b429033da773c1f155e98607d1d60bd63e1b07deca2b454493bd5b8122cc265bbeb7

Download Submit
C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe

Filesize
2.0MB

MD5
6b68f3be3850e9b2ac03bad9f4de5b88

SHA1
57c59090e38d6e0128874ed93f53a4e3c65ee47b

SHA256
159a30c008bb234af56a7c786cb5352e7b96dc62fac6b2ca2ea7fa75fc6841b7

SHA512
de8b266ef96aec59987e025dfccd51d8bd91e7e4523c6bc4ccab73de5819b429033da773c1f155e98607d1d60bd63e1b07deca2b454493bd5b8122cc265bbeb7

Download Submit
C:\Users\Admin\Downloads\RobloxPlayerLauncher.exe

Filesize
2.0MB

MD5
6b68f3be3850e9b2ac03bad9f4de5b88

SHA1
57c59090e38d6e0128874ed93f53a4e3c65ee47b

SHA256
159a30c008bb234af56a7c786cb5352e7b96dc62fac6b2ca2ea7fa75fc6841b7

SHA512
de8b266ef96aec59987e025dfccd51d8bd91e7e4523c6bc4ccab73de5819b429033da773c1f155e98607d1d60bd63e1b07deca2b454493bd5b8122cc265bbeb7

Download Submit
C:\Users\Admin\Downloads\krnl\7za.exe

Filesize
628KB

MD5
ec79cabd55a14379e4d676bb17d9e3df

SHA1
15626d505da35bfdb33aea5c8f7831f616cabdba

SHA256
44a55f5d9c31d0990de47b9893e0c927478930cef06fbe2d1f520a6d6cba587d

SHA512
00bbb601a685cbfb3c51c1da9f3b77c2b318c79e87d88a31c0e215288101753679e1586b170ccc9c2cb0b5ce05c2090c0737a1e4a616ad1d9658392066196d47

Download Submit
C:\Users\Admin\Downloads\krnl\7za.exe

Filesize
628KB

MD5
ec79cabd55a14379e4d676bb17d9e3df

SHA1
15626d505da35bfdb33aea5c8f7831f616cabdba

SHA256
44a55f5d9c31d0990de47b9893e0c927478930cef06fbe2d1f520a6d6cba587d

SHA512
00bbb601a685cbfb3c51c1da9f3b77c2b318c79e87d88a31c0e215288101753679e1586b170ccc9c2cb0b5ce05c2090c0737a1e4a616ad1d9658392066196d47

Download Submit
C:\Users\Admin\Downloads\krnl\7za.exe

Filesize
628KB

MD5
ec79cabd55a14379e4d676bb17d9e3df

SHA1
15626d505da35bfdb33aea5c8f7831f616cabdba

SHA256
44a55f5d9c31d0990de47b9893e0c927478930cef06fbe2d1f520a6d6cba587d

SHA512
00bbb601a685cbfb3c51c1da9f3b77c2b318c79e87d88a31c0e215288101753679e1586b170ccc9c2cb0b5ce05c2090c0737a1e4a616ad1d9658392066196d47

Download Submit
C:\Users\Admin\Downloads\krnl\Bunifu_UI_v1.5.3.dll

Filesize
236KB

MD5
2ecb51ab00c5f340380ecf849291dbcf

SHA1
1a4dffbce2a4ce65495ed79eab42a4da3b660931

SHA256
f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf

SHA512
e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b

Download Submit
C:\Users\Admin\Downloads\krnl\Bunifu_UI_v1.5.3.dll

Filesize
236KB

MD5
2ecb51ab00c5f340380ecf849291dbcf

SHA1
1a4dffbce2a4ce65495ed79eab42a4da3b660931

SHA256
f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf

SHA512
e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b

Download Submit
C:\Users\Admin\Downloads\krnl\Bunifu_UI_v1.5.3.dll

Filesize
236KB

MD5
2ecb51ab00c5f340380ecf849291dbcf

SHA1
1a4dffbce2a4ce65495ed79eab42a4da3b660931

SHA256
f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf

SHA512
e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b

Download Submit
C:\Users\Admin\Downloads\krnl\ScintillaNET.dll

Filesize
1.3MB

MD5
9166536c31f4e725e6befe85e2889a4b

SHA1
f0cd8253b7e64157d39a8dc5feb8cf7bda7e8dae

SHA256
ad0cc5a4d4a6aae06ee360339c851892b74b8a275ce89c1b48185672179f3163

SHA512
113a7b77d2d557d135470787deead744d42f8292d853e2b55074e9cb3591fd045ffd10e5c81b5c15dde55861b806363568611e591ae25dcb31cf011da7e72562

Download Submit
C:\Users\Admin\Downloads\krnl\ScintillaNET.dll

Filesize
1.3MB

MD5
9166536c31f4e725e6befe85e2889a4b

SHA1
f0cd8253b7e64157d39a8dc5feb8cf7bda7e8dae

SHA256
ad0cc5a4d4a6aae06ee360339c851892b74b8a275ce89c1b48185672179f3163

SHA512
113a7b77d2d557d135470787deead744d42f8292d853e2b55074e9cb3591fd045ffd10e5c81b5c15dde55861b806363568611e591ae25dcb31cf011da7e72562

Download Submit
C:\Users\Admin\Downloads\krnl\ScintillaNET.dll

Filesize
1.3MB

MD5
9166536c31f4e725e6befe85e2889a4b

SHA1
f0cd8253b7e64157d39a8dc5feb8cf7bda7e8dae

SHA256
ad0cc5a4d4a6aae06ee360339c851892b74b8a275ce89c1b48185672179f3163

SHA512
113a7b77d2d557d135470787deead744d42f8292d853e2b55074e9cb3591fd045ffd10e5c81b5c15dde55861b806363568611e591ae25dcb31cf011da7e72562

Download Submit
C:\Users\Admin\Downloads\krnl\bin\Monaco.zip

Filesize
641KB

MD5
1a19fd7c42169c76e75e685dca02c190

SHA1
f16b4697bcd348d44965bf9ded731523db9bd606

SHA256
d686209afbbe718dc0506356e934ff190c1259a174aba12ef40a2fe7a014a331

SHA512
93d27188aab662ffffd78cfc31d100f161656ef37fe4f420a2cc2d514c935bce85b1e9b54eb374c94ba0ac75d0624e24676f8e359c32c9d3485aa5d7bbb14dd4

Download Submit
C:\Users\Admin\Downloads\krnl\bin\src.7z

Filesize
52.5MB

MD5
7c380ecd5bc2cd51511d0ee5b58df745

SHA1
615749979477621579dd9b04ada8d4dcd9430f1e

SHA256
38e1b82e4c9a2a8159c1c60afe7668855351a6e9b52fb13f6dcc633202abaf07

SHA512
110836411f3b44f1df8ecc5890f59d7b5b10d6175f627cc160f0fa5bbc72408c1463ac7067d9787ff9a18e50b9460edf2e2f0b3a418532cc9a273965da1cc1de

Download Submit
C:\Users\Admin\Downloads\krnl\bin\src\CefSharp.Core.dll

Filesize
1.3MB

MD5
c7430597fb837d6bc7549b988bdc78a5

SHA1
447d90f6cad3afe3d2c47fd45f730c68d3201990

SHA256
531585fb2ae180dab6c32b577a964279d8c26a517271f05c3a22940594568f88

SHA512
41567ff616ed0b8fd37f0095c71326fa16c23b33e390b9f224c03eaa5bb33ce06f4e0b60e1ea7ce552f1f47ea38b749a50e16a8e2fcf69f364c8f210a3ad0ae1

Download Submit
C:\Users\Admin\Downloads\krnl\bin\src\CefSharp.Core.dll

Filesize
1.3MB

MD5
c7430597fb837d6bc7549b988bdc78a5

SHA1
447d90f6cad3afe3d2c47fd45f730c68d3201990

SHA256
531585fb2ae180dab6c32b577a964279d8c26a517271f05c3a22940594568f88

SHA512
41567ff616ed0b8fd37f0095c71326fa16c23b33e390b9f224c03eaa5bb33ce06f4e0b60e1ea7ce552f1f47ea38b749a50e16a8e2fcf69f364c8f210a3ad0ae1

Download Submit
C:\Users\Admin\Downloads\krnl\bin\src\CefSharp.Core.dll

Filesize
1.3MB

MD5
c7430597fb837d6bc7549b988bdc78a5

SHA1
447d90f6cad3afe3d2c47fd45f730c68d3201990

SHA256
531585fb2ae180dab6c32b577a964279d8c26a517271f05c3a22940594568f88

SHA512
41567ff616ed0b8fd37f0095c71326fa16c23b33e390b9f224c03eaa5bb33ce06f4e0b60e1ea7ce552f1f47ea38b749a50e16a8e2fcf69f364c8f210a3ad0ae1

Download Submit
C:\Users\Admin\Downloads\krnl\bin\src\CefSharp.Core.dll

Filesize
1.3MB

MD5
c7430597fb837d6bc7549b988bdc78a5

SHA1
447d90f6cad3afe3d2c47fd45f730c68d3201990

SHA256
531585fb2ae180dab6c32b577a964279d8c26a517271f05c3a22940594568f88

SHA512
41567ff616ed0b8fd37f0095c71326fa16c23b33e390b9f224c03eaa5bb33ce06f4e0b60e1ea7ce552f1f47ea38b749a50e16a8e2fcf69f364c8f210a3ad0ae1

Download Submit
C:\Users\Admin\Downloads\krnl\bin\src\CefSharp.Core.dll

Filesize
1.3MB

MD5
c7430597fb837d6bc7549b988bdc78a5

SHA1
447d90f6cad3afe3d2c47fd45f730c68d3201990

SHA256
531585fb2ae180dab6c32b577a964279d8c26a517271f05c3a22940594568f88

SHA512
41567ff616ed0b8fd37f0095c71326fa16c23b33e390b9f224c03eaa5bb33ce06f4e0b60e1ea7ce552f1f47ea38b749a50e16a8e2fcf69f364c8f210a3ad0ae1

Download Submit
C:\Users\Admin\Downloads\krnl\bin\src\CefSharp.Core.dll

Filesize
1.3MB

MD5
c7430597fb837d6bc7549b988bdc78a5

SHA1
447d90f6cad3afe3d2c47fd45f730c68d3201990

SHA256
531585fb2ae180dab6c32b577a964279d8c26a517271f05c3a22940594568f88

SHA512
41567ff616ed0b8fd37f0095c71326fa16c23b33e390b9f224c03eaa5bb33ce06f4e0b60e1ea7ce552f1f47ea38b749a50e16a8e2fcf69f364c8f210a3ad0ae1

Download Submit
C:\Users\Admin\Downloads\krnl\bin\src\CefSharp.OffScreen.dll

Filesize
27KB

MD5
103d84c4a22967defcbedaea6e11720f

SHA1
f33ff1b8d18ba90ec6dc641dd9a6666746fc72a2

SHA256
7984b97cf1aa2a45381bf4d1849a70c3a37527da6c433b0ff6771912c28d20f2

SHA512
410e63fdae507b97d61b815a846a9ccfd655da4ff23e39652be182e139a974a4a26cc8d4c22057da99c42ce59f215db2f87a173d99ba9cd9a16f392671476fe7

Download Submit
C:\Users\Admin\Downloads\krnl\bin\src\CefSharp.OffScreen.dll

Filesize
27KB

MD5
103d84c4a22967defcbedaea6e11720f

SHA1
f33ff1b8d18ba90ec6dc641dd9a6666746fc72a2

SHA256
7984b97cf1aa2a45381bf4d1849a70c3a37527da6c433b0ff6771912c28d20f2

SHA512
410e63fdae507b97d61b815a846a9ccfd655da4ff23e39652be182e139a974a4a26cc8d4c22057da99c42ce59f215db2f87a173d99ba9cd9a16f392671476fe7

Download Submit
C:\Users\Admin\Downloads\krnl\bin\src\CefSharp.OffScreen.dll

Filesize
27KB

MD5
103d84c4a22967defcbedaea6e11720f

SHA1
f33ff1b8d18ba90ec6dc641dd9a6666746fc72a2

SHA256
7984b97cf1aa2a45381bf4d1849a70c3a37527da6c433b0ff6771912c28d20f2

SHA512
410e63fdae507b97d61b815a846a9ccfd655da4ff23e39652be182e139a974a4a26cc8d4c22057da99c42ce59f215db2f87a173d99ba9cd9a16f392671476fe7

Download Submit
C:\Users\Admin\Downloads\krnl\bin\src\CefSharp.OffScreen.dll

Filesize
27KB

MD5
103d84c4a22967defcbedaea6e11720f

SHA1
f33ff1b8d18ba90ec6dc641dd9a6666746fc72a2

SHA256
7984b97cf1aa2a45381bf4d1849a70c3a37527da6c433b0ff6771912c28d20f2

SHA512
410e63fdae507b97d61b815a846a9ccfd655da4ff23e39652be182e139a974a4a26cc8d4c22057da99c42ce59f215db2f87a173d99ba9cd9a16f392671476fe7

Download Submit
C:\Users\Admin\Downloads\krnl\bin\src\CefSharp.OffScreen.dll

Filesize
27KB

MD5
103d84c4a22967defcbedaea6e11720f

SHA1
f33ff1b8d18ba90ec6dc641dd9a6666746fc72a2

SHA256
7984b97cf1aa2a45381bf4d1849a70c3a37527da6c433b0ff6771912c28d20f2

SHA512
410e63fdae507b97d61b815a846a9ccfd655da4ff23e39652be182e139a974a4a26cc8d4c22057da99c42ce59f215db2f87a173d99ba9cd9a16f392671476fe7

Download Submit
C:\Users\Admin\Downloads\krnl\bin\src\CefSharp.WinForms.dll

Filesize
29KB

MD5
5e5fe029bff022007c27d024ae7cf262

SHA1
fb7250ec8ca1acd36023b966fae61e85fe2c8ab4

SHA256
7bee1ead1fe16cc4bae25758d1708163489724427f4b540b21ce1e943f070c3b

SHA512
60df60ca9c12295057afb10a050587010ac6326f8e636ef811bb13ef891aa19c98a54ca2e7514181f93a9622677c82d73ea13fb4e72a14f62911eb5ca9073216

Download Submit
C:\Users\Admin\Downloads\krnl\bin\src\CefSharp.WinForms.dll

Filesize
29KB

MD5
5e5fe029bff022007c27d024ae7cf262

SHA1
fb7250ec8ca1acd36023b966fae61e85fe2c8ab4

SHA256
7bee1ead1fe16cc4bae25758d1708163489724427f4b540b21ce1e943f070c3b

SHA512
60df60ca9c12295057afb10a050587010ac6326f8e636ef811bb13ef891aa19c98a54ca2e7514181f93a9622677c82d73ea13fb4e72a14f62911eb5ca9073216

Download Submit
C:\Users\Admin\Downloads\krnl\bin\src\CefSharp.WinForms.dll

Filesize
29KB

MD5
5e5fe029bff022007c27d024ae7cf262

SHA1
fb7250ec8ca1acd36023b966fae61e85fe2c8ab4

SHA256
7bee1ead1fe16cc4bae25758d1708163489724427f4b540b21ce1e943f070c3b

SHA512
60df60ca9c12295057afb10a050587010ac6326f8e636ef811bb13ef891aa19c98a54ca2e7514181f93a9622677c82d73ea13fb4e72a14f62911eb5ca9073216

Download Submit
C:\Users\Admin\Downloads\krnl\bin\src\CefSharp.WinForms.dll

Filesize
29KB

MD5
5e5fe029bff022007c27d024ae7cf262

SHA1
fb7250ec8ca1acd36023b966fae61e85fe2c8ab4

SHA256
7bee1ead1fe16cc4bae25758d1708163489724427f4b540b21ce1e943f070c3b

SHA512
60df60ca9c12295057afb10a050587010ac6326f8e636ef811bb13ef891aa19c98a54ca2e7514181f93a9622677c82d73ea13fb4e72a14f62911eb5ca9073216

Download Submit
C:\Users\Admin\Downloads\krnl\bin\src\CefSharp.WinForms.dll

Filesize
29KB

MD5
5e5fe029bff022007c27d024ae7cf262

SHA1
fb7250ec8ca1acd36023b966fae61e85fe2c8ab4

SHA256
7bee1ead1fe16cc4bae25758d1708163489724427f4b540b21ce1e943f070c3b

SHA512
60df60ca9c12295057afb10a050587010ac6326f8e636ef811bb13ef891aa19c98a54ca2e7514181f93a9622677c82d73ea13fb4e72a14f62911eb5ca9073216

Download Submit
C:\Users\Admin\Downloads\krnl\bin\src\CefSharp.dll

Filesize
218KB

MD5
5f79e7737e5e8be2cf8711374c114e85

SHA1
86eabaa284074dd2f86f856cea043061091897ef

SHA256
5b6ca21a1bc2c31640cf7bd270f8d69df7ca547d26828cabc25656b06a9f3f72

SHA512
41ea9a9a4f666a152b17f05a01571ba1c27b07051489660e923a94366bc66225530eabd8f1e3bef3da65feaa98ede44f0105092c86d526ab30b604b88c494f95

Download Submit
C:\Users\Admin\Downloads\krnl\bin\src\CefSharp.dll

Filesize
218KB

MD5
5f79e7737e5e8be2cf8711374c114e85

SHA1
86eabaa284074dd2f86f856cea043061091897ef

SHA256
5b6ca21a1bc2c31640cf7bd270f8d69df7ca547d26828cabc25656b06a9f3f72

SHA512
41ea9a9a4f666a152b17f05a01571ba1c27b07051489660e923a94366bc66225530eabd8f1e3bef3da65feaa98ede44f0105092c86d526ab30b604b88c494f95

Download Submit
C:\Users\Admin\Downloads\krnl\bin\src\CefSharp.dll

Filesize
218KB

MD5
5f79e7737e5e8be2cf8711374c114e85

SHA1
86eabaa284074dd2f86f856cea043061091897ef

SHA256
5b6ca21a1bc2c31640cf7bd270f8d69df7ca547d26828cabc25656b06a9f3f72

SHA512
41ea9a9a4f666a152b17f05a01571ba1c27b07051489660e923a94366bc66225530eabd8f1e3bef3da65feaa98ede44f0105092c86d526ab30b604b88c494f95

Download Submit
C:\Users\Admin\Downloads\krnl\bin\src\CefSharp.dll

Filesize
218KB

MD5
5f79e7737e5e8be2cf8711374c114e85

SHA1
86eabaa284074dd2f86f856cea043061091897ef

SHA256
5b6ca21a1bc2c31640cf7bd270f8d69df7ca547d26828cabc25656b06a9f3f72

SHA512
41ea9a9a4f666a152b17f05a01571ba1c27b07051489660e923a94366bc66225530eabd8f1e3bef3da65feaa98ede44f0105092c86d526ab30b604b88c494f95

Download Submit
C:\Users\Admin\Downloads\krnl\bin\src\CefSharp.dll

Filesize
218KB

MD5
5f79e7737e5e8be2cf8711374c114e85

SHA1
86eabaa284074dd2f86f856cea043061091897ef

SHA256
5b6ca21a1bc2c31640cf7bd270f8d69df7ca547d26828cabc25656b06a9f3f72

SHA512
41ea9a9a4f666a152b17f05a01571ba1c27b07051489660e923a94366bc66225530eabd8f1e3bef3da65feaa98ede44f0105092c86d526ab30b604b88c494f95

Download Submit
C:\Users\Admin\Downloads\krnl\bin\src\chrome_elf.dll

Filesize
788KB

MD5
6499ea6b92ab4971886bd06c12625819

SHA1
5ebb75eeca7625b9511233158a02f50a92867a39

SHA256
6820f276c0d71557a0c7b997fd2f4a3ac6a45c86454c4dc3bcfa29843b5c470b

SHA512
e57703730e42eb9d80e762337e08176705b349f54fbd429edc657d44c9dc3a1f9ccfa594bc3ef622798aebb5bc69b225abb266b00f9b350ae59f734c2f31f63d

Download Submit
C:\Users\Admin\Downloads\krnl\bin\src\chrome_elf.dll

Filesize
788KB

MD5
6499ea6b92ab4971886bd06c12625819

SHA1
5ebb75eeca7625b9511233158a02f50a92867a39

SHA256
6820f276c0d71557a0c7b997fd2f4a3ac6a45c86454c4dc3bcfa29843b5c470b

SHA512
e57703730e42eb9d80e762337e08176705b349f54fbd429edc657d44c9dc3a1f9ccfa594bc3ef622798aebb5bc69b225abb266b00f9b350ae59f734c2f31f63d

Download Submit
C:\Users\Admin\Downloads\krnl\bin\src\libcef.dll

Filesize
96.9MB

MD5
8c51876f1b5dfbf4964732a65c1f2724

SHA1
ed5653a3a5655ba65d6221285da93799bd2517f9

SHA256
5ae7eff0a7b91e54d211046111d088ed8820793c97ee689f20371c356af6b46e

SHA512
a4bb49b64b58767fcaf5b3b889a63c0917d56c59dd48283539903a6856caf69c5ce35655e68ef8bdad1e9bc80002fd2f68fc1e46977ba68926f7a731904a7884

Download Submit
C:\Users\Admin\Downloads\krnl\bin\src\libcef.dll

Filesize
96.9MB

MD5
8c51876f1b5dfbf4964732a65c1f2724

SHA1
ed5653a3a5655ba65d6221285da93799bd2517f9

SHA256
5ae7eff0a7b91e54d211046111d088ed8820793c97ee689f20371c356af6b46e

SHA512
a4bb49b64b58767fcaf5b3b889a63c0917d56c59dd48283539903a6856caf69c5ce35655e68ef8bdad1e9bc80002fd2f68fc1e46977ba68926f7a731904a7884

Download Submit
C:\Users\Admin\Downloads\krnl\krnlss.exe

Filesize
1.5MB

MD5
4d7c519cc2127f785d13694d7a281f33

SHA1
6d5d49494ca03fb99f7124197296d43c68d0c027

SHA256
6da486f47b7cdc5f54bad208ae48a25e3f1827fed64d1455c9d986b68d37f7b5

SHA512
50ec05f9cf9b6c4309be0b18f40124b703700672fe784bf3d12c470e647409cb5824dce79f7a4db2e5be83b3be8879f248c1549e37e6633cb7369909527e99a5

Download Submit
C:\Users\Admin\Downloads\krnl\krnlss.exe

Filesize
1.5MB

MD5
4d7c519cc2127f785d13694d7a281f33

SHA1
6d5d49494ca03fb99f7124197296d43c68d0c027

SHA256
6da486f47b7cdc5f54bad208ae48a25e3f1827fed64d1455c9d986b68d37f7b5

SHA512
50ec05f9cf9b6c4309be0b18f40124b703700672fe784bf3d12c470e647409cb5824dce79f7a4db2e5be83b3be8879f248c1549e37e6633cb7369909527e99a5

Download Submit
C:\Users\Admin\Downloads\krnl\krnlss.exe

Filesize
1.5MB

MD5
4d7c519cc2127f785d13694d7a281f33

SHA1
6d5d49494ca03fb99f7124197296d43c68d0c027

SHA256
6da486f47b7cdc5f54bad208ae48a25e3f1827fed64d1455c9d986b68d37f7b5

SHA512
50ec05f9cf9b6c4309be0b18f40124b703700672fe784bf3d12c470e647409cb5824dce79f7a4db2e5be83b3be8879f248c1549e37e6633cb7369909527e99a5

Download Submit
C:\Users\Admin\Downloads\krnl\krnlss.exe.config

Filesize
202B

MD5
0ed4b3831ff5e91dff636145f68aac4c

SHA1
2d1140812945dc1b9e400a88c911803639cb2e49

SHA256
03962ae5a55dfc70e2717771a9a7aa37b956b2c5b4c62e3cff9fe24360250347

SHA512
4039d0272678777ba6fa496baf875050bd4c29352fffd37af8c3c07fb2abeedc54ba04a3dd085b491d848e951ccfcbd67ec7ba50a10ec0c624df45e98c18bf1c

Download Submit
C:\Users\Admin\Downloads\krnl_bootstrapper.exe

Filesize
1.2MB

MD5
f14153bbd95fc26d9ccea77c49cf09b9

SHA1
cb59f900711ea751c4322b4dab50fa2c0ee70b33

SHA256
27eab496d0b63d52c18cee063110d9d479523b58426bfcb58e420a5cae087c54

SHA512
7f7618cf6f15d85e82cbfff07ca6e1df0aa763d64d6a37fb659f1612b950d16a15b723ec053765e991485e74a7301617019b166dcaa759ed6f1a281a9ebc4ed0

Download Submit
C:\Users\Admin\Downloads\krnl_bootstrapper.exe

Filesize
1.2MB

MD5
f14153bbd95fc26d9ccea77c49cf09b9

SHA1
cb59f900711ea751c4322b4dab50fa2c0ee70b33

SHA256
27eab496d0b63d52c18cee063110d9d479523b58426bfcb58e420a5cae087c54

SHA512
7f7618cf6f15d85e82cbfff07ca6e1df0aa763d64d6a37fb659f1612b950d16a15b723ec053765e991485e74a7301617019b166dcaa759ed6f1a281a9ebc4ed0

Download Submit
C:\Users\Admin\Downloads\krnl_bootstrapper.f-Ar3msv.exe.part

Filesize
1.2MB

MD5
f14153bbd95fc26d9ccea77c49cf09b9

SHA1
cb59f900711ea751c4322b4dab50fa2c0ee70b33

SHA256
27eab496d0b63d52c18cee063110d9d479523b58426bfcb58e420a5cae087c54

SHA512
7f7618cf6f15d85e82cbfff07ca6e1df0aa763d64d6a37fb659f1612b950d16a15b723ec053765e991485e74a7301617019b166dcaa759ed6f1a281a9ebc4ed0

Download Submit
C:\Users\Admin\Videos\Captures\desktop.ini

Filesize
190B

MD5
b0d27eaec71f1cd73b015f5ceeb15f9d

SHA1
62264f8b5c2f5034a1e4143df6e8c787165fbc2f

SHA256
86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2

SHA512
7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c

Download Submit
memory/3196-5141-0x0000020E8BE40000-0x0000020E8BE41000-memory.dmp

Filesize
4KB

Download
memory/3196-5352-0x0000020E88030000-0x0000020E880C5000-memory.dmp

Filesize
596KB

Download
memory/3196-5140-0x0000020E8BE40000-0x0000020E8BE41000-memory.dmp

Filesize
4KB

Download
memory/3196-5143-0x0000020E8BE40000-0x0000020E8BE41000-memory.dmp

Filesize
4KB

Download
memory/3196-5159-0x0000020E8BE40000-0x0000020E8BE41000-memory.dmp

Filesize
4KB

Download
memory/3196-5161-0x0000020E8BE40000-0x0000020E8BE41000-memory.dmp

Filesize
4KB

Download
memory/3196-5162-0x0000020E8BE40000-0x0000020E8BE41000-memory.dmp

Filesize
4KB

Download
memory/3196-5163-0x0000020E8BE40000-0x0000020E8BE41000-memory.dmp

Filesize
4KB

Download
memory/3196-5160-0x0000020E8BE40000-0x0000020E8BE41000-memory.dmp

Filesize
4KB

Download
memory/3196-5158-0x0000020E8BE40000-0x0000020E8BE41000-memory.dmp

Filesize
4KB

Download
memory/3196-5157-0x0000020E8BE40000-0x0000020E8BE41000-memory.dmp

Filesize
4KB

Download
memory/3196-5178-0x0000020E88030000-0x0000020E880C5000-memory.dmp

Filesize
596KB

Download
memory/4648-1677-0x00000000066E0000-0x000000000671C000-memory.dmp

Filesize
240KB

Download
memory/4648-1674-0x0000000006420000-0x0000000006432000-memory.dmp

Filesize
72KB

Download
memory/4648-1717-0x0000000008220000-0x0000000008252000-memory.dmp

Filesize
200KB

Download
memory/4648-1898-0x000000000A990000-0x000000000AA90000-memory.dmp

Filesize
1024KB

Download
memory/4648-1716-0x0000000007A90000-0x0000000007ABA000-memory.dmp

Filesize
168KB

Download
memory/4648-1712-0x0000000007B50000-0x0000000007B94000-memory.dmp

Filesize
272KB

Download
memory/4648-1887-0x00000000050A0000-0x00000000050B0000-memory.dmp

Filesize
64KB

Download
memory/4648-1702-0x00000000078C0000-0x00000000078E2000-memory.dmp

Filesize
136KB

Download
memory/4648-1709-0x0000000007990000-0x00000000079B4000-memory.dmp

Filesize
144KB

Download
memory/4648-1708-0x0000000007AF0000-0x0000000007B50000-memory.dmp

Filesize
384KB

Download
memory/4648-1706-0x00000000078F0000-0x000000000790A000-memory.dmp

Filesize
104KB

Download
memory/4648-1707-0x0000000007BC0000-0x0000000007CE2000-memory.dmp

Filesize
1.1MB

Download
memory/4648-1880-0x00000000050A0000-0x00000000050B0000-memory.dmp

Filesize
64KB

Download
memory/4648-1703-0x0000000007300000-0x000000000731A000-memory.dmp

Filesize
104KB

Download
memory/4648-1705-0x0000000007940000-0x0000000007984000-memory.dmp

Filesize
272KB

Download
memory/4648-1704-0x00000000079C0000-0x0000000007A8E000-memory.dmp

Filesize
824KB

Download
memory/4648-1701-0x0000000007880000-0x00000000078B2000-memory.dmp

Filesize
200KB

Download
memory/4648-1700-0x00000000072A0000-0x00000000072C0000-memory.dmp

Filesize
128KB

Download
memory/4648-1699-0x00000000072D0000-0x00000000072F2000-memory.dmp

Filesize
136KB

Download
memory/4648-1755-0x0000000008AE0000-0x0000000008AEE000-memory.dmp

Filesize
56KB

Download
memory/4648-1698-0x0000000007280000-0x00000000072A0000-memory.dmp

Filesize
128KB

Download
memory/4648-1692-0x0000000007250000-0x000000000725A000-memory.dmp

Filesize
40KB

Download
memory/4648-1719-0x0000000008500000-0x0000000008676000-memory.dmp

Filesize
1.5MB

Download
memory/4648-1720-0x0000000008420000-0x00000000084BC000-memory.dmp

Filesize
624KB

Download
memory/4648-1691-0x0000000007D50000-0x000000000821C000-memory.dmp

Filesize
4.8MB

Download
memory/4648-1690-0x00000000071A0000-0x00000000071BC000-memory.dmp

Filesize
112KB

Download
memory/4648-1689-0x0000000007180000-0x000000000719E000-memory.dmp

Filesize
120KB

Download
memory/4648-1688-0x00000000067C0000-0x00000000067E2000-memory.dmp

Filesize
136KB

Download
memory/4648-1687-0x0000000007350000-0x000000000787C000-memory.dmp

Filesize
5.2MB

Download
memory/4648-1727-0x0000000008380000-0x00000000083E6000-memory.dmp

Filesize
408KB

Download
memory/4648-1683-0x00000000050A0000-0x00000000050B0000-memory.dmp

Filesize
64KB

Download
memory/4648-1843-0x00000000050A0000-0x00000000050B0000-memory.dmp

Filesize
64KB

Download
memory/4648-1678-0x0000000006720000-0x0000000006776000-memory.dmp

Filesize
344KB

Download
memory/4648-1676-0x0000000006670000-0x00000000066D6000-memory.dmp

Filesize
408KB

Download
memory/4648-1675-0x0000000006490000-0x00000000064E0000-memory.dmp

Filesize
320KB

Download
memory/4648-1726-0x0000000008BE0000-0x0000000008D66000-memory.dmp

Filesize
1.5MB

Download
memory/4648-1728-0x0000000008B10000-0x0000000008BCA000-memory.dmp

Filesize
744KB

Download
memory/4648-1820-0x000000000BFD0000-0x000000000BFEE000-memory.dmp

Filesize
120KB

Download
memory/4648-1718-0x00000000082F0000-0x000000000837C000-memory.dmp

Filesize
560KB

Download
memory/4648-1673-0x00000000064F0000-0x00000000065FA000-memory.dmp

Filesize
1.0MB

Download
memory/4648-1672-0x0000000006800000-0x0000000006E18000-memory.dmp

Filesize
6.1MB

Download
memory/4648-1666-0x0000000006120000-0x0000000006132000-memory.dmp

Filesize
72KB

Download
memory/4648-1665-0x00000000061A0000-0x00000000061DC000-memory.dmp

Filesize
240KB

Download
memory/4648-1729-0x0000000008290000-0x00000000082B2000-memory.dmp

Filesize
136KB

Download
memory/4648-1730-0x0000000007D40000-0x0000000007D4C000-memory.dmp

Filesize
48KB

Download
memory/4648-1809-0x000000000BDA0000-0x000000000BE16000-memory.dmp

Filesize
472KB

Download
memory/4648-1662-0x0000000006160000-0x000000000619E000-memory.dmp

Filesize
248KB

Download
memory/4648-1795-0x000000000A990000-0x000000000AA90000-memory.dmp

Filesize
1024KB

Download
memory/4648-1799-0x000000000BE70000-0x000000000BFC4000-memory.dmp

Filesize
1.3MB

Download
memory/4648-1639-0x0000000004D90000-0x0000000004E22000-memory.dmp

Filesize
584KB

Download
memory/4648-1635-0x00000000054A0000-0x0000000005A44000-memory.dmp

Filesize
5.6MB

Download
memory/4648-1632-0x0000000000360000-0x00000000004E4000-memory.dmp

Filesize
1.5MB

Download
memory/4648-1761-0x0000000008AF0000-0x0000000008AFE000-memory.dmp

Filesize
56KB

Download
memory/4648-1772-0x0000000009190000-0x00000000091D2000-memory.dmp

Filesize
264KB

Download
memory/4648-1773-0x00000000050A0000-0x00000000050B0000-memory.dmp

Filesize
64KB

Download
memory/4648-1751-0x00000000090D0000-0x000000000911A000-memory.dmp

Filesize
296KB

Download
memory/4648-1784-0x00000000050A0000-0x00000000050B0000-memory.dmp

Filesize
64KB

Download
memory/4868-855-0x00000000000B0000-0x00000000001DA000-memory.dmp

Filesize
1.2MB

Download
memory/4868-900-0x00000000094D0000-0x00000000094DE000-memory.dmp

Filesize
56KB

Download
memory/4868-899-0x00000000094F0000-0x0000000009528000-memory.dmp

Filesize
224KB

Download
memory/4868-1037-0x0000000004C80000-0x0000000004C90000-memory.dmp

Filesize
64KB

Download
memory/4868-886-0x0000000004C80000-0x0000000004C90000-memory.dmp

Filesize
64KB

Download
memory/4868-890-0x0000000009470000-0x0000000009478000-memory.dmp

Filesize
32KB

Download
memory/4868-887-0x0000000004C80000-0x0000000004C90000-memory.dmp

Filesize
64KB

Download
memory/5712-1841-0x00000000029F0000-0x0000000002A85000-memory.dmp

Filesize
596KB

Download
memory/5712-1317-0x00000000029F0000-0x0000000002A85000-memory.dmp

Filesize
596KB

Download
memory/5712-1318-0x0000000005390000-0x0000000005439000-memory.dmp

Filesize
676KB

Download
memory/5712-5692-0x00000000029F0000-0x0000000002A85000-memory.dmp

Filesize
596KB

Download
memory/5896-5764-0x0000000000580000-0x0000000000581000-memory.dmp

Filesize
4KB

Download
memory/5896-5765-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/5896-5766-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/5896-5767-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/5896-5768-0x00000000005D0000-0x0000000005CFA000-memory.dmp

Filesize
87.2MB

Download
memory/5896-5762-0x0000000000450000-0x0000000000451000-memory.dmp

Filesize
4KB

Download
memory/5896-5763-0x0000000000460000-0x0000000000461000-memory.dmp

Filesize
4KB

Download